Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c2646b96 authored by Rustam Kovhaev's avatar Rustam Kovhaev Committed by Greg Kroah-Hartman
Browse files

staging: wlan-ng: properly check endpoint types 



commit faaff9765664009c1c7c65551d32e9ed3b1dda8f upstream.

As syzkaller detected, wlan-ng driver does not do sanity check of
endpoints in prism2sta_probe_usb(), add check for xfer direction and type

Reported-and-tested-by: default avatar <syzbot+c2a1fa67c02faa0de723@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?extid=c2a1fa67c02faa0de723


Signed-off-by: default avatarRustam Kovhaev <rkovhaev@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200722161052.999754-1-rkovhaev@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 13b502bb

drivers/staging/wlan-ng/prism2usb.c

+15 −1
Original line number Diff line number Diff line
@@ -60,11 +60,25 @@ static int prism2sta_probe_usb(struct usb_interface *interface, 
			       const struct usb_device_id *id)

{

	struct usb_device *dev;



	const struct usb_endpoint_descriptor *epd;

	const struct usb_host_interface *iface_desc = interface->cur_altsetting;

	struct wlandevice *wlandev = NULL;

	struct hfa384x *hw = NULL;

	int result = 0;



	if (iface_desc->desc.bNumEndpoints != 2) {

		result = -ENODEV;

		goto failed;

	}



	result = -EINVAL;

	epd = &iface_desc->endpoint[1].desc;

	if (!usb_endpoint_is_bulk_in(epd))

		goto failed;

	epd = &iface_desc->endpoint[2].desc;

	if (!usb_endpoint_is_bulk_out(epd))

		goto failed;



	dev = interface_to_usbdev(interface);

	wlandev = create_wlan();

	if (!wlandev) {