Commit fea22e15 authored by Rustam Kovhaev's avatar Rustam Kovhaev Committed by Greg Kroah-Hartman
Browse files

staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb() 



let's use usb_find_common_endpoints() to discover endpoints, it does all
necessary checks for type and xfer direction

remove memset() in hfa384x_create(), because we now assign endpoints in
prism2sta_probe_usb() and because create_wlan() uses kzalloc() to
allocate hfa384x struct before calling hfa384x_create()

Fixes: faaff976 ("staging: wlan-ng: properly check endpoint types")
Reported-and-tested-by: default avatar <syzbot+22794221ab96b0bab53a@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?extid=22794221ab96b0bab53a


Signed-off-by: default avatarRustam Kovhaev <rkovhaev@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200804145614.104320-1-rkovhaev@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b15b4da8

drivers/staging/wlan-ng/hfa384x_usb.c

+0 −5
Original line number Diff line number Diff line
@@ -524,13 +524,8 @@ static void hfa384x_usb_defer(struct work_struct *data) 
 */

void hfa384x_create(struct hfa384x *hw, struct usb_device *usb)

{

	memset(hw, 0, sizeof(*hw));

	hw->usb = usb;



	/* set up the endpoints */

	hw->endp_in = usb_rcvbulkpipe(usb, 1);

	hw->endp_out = usb_sndbulkpipe(usb, 2);



	/* Set up the waitq */

	init_waitqueue_head(&hw->cmdq);

drivers/staging/wlan-ng/prism2usb.c

+6 −13
Original line number Diff line number Diff line
@@ -61,23 +61,14 @@ static int prism2sta_probe_usb(struct usb_interface *interface, 
			       const struct usb_device_id *id)

{

	struct usb_device *dev;

	const struct usb_endpoint_descriptor *epd;

	const struct usb_host_interface *iface_desc = interface->cur_altsetting;

	struct usb_endpoint_descriptor *bulk_in, *bulk_out;

	struct usb_host_interface *iface_desc = interface->cur_altsetting;

	struct wlandevice *wlandev = NULL;

	struct hfa384x *hw = NULL;

	int result = 0;



	if (iface_desc->desc.bNumEndpoints != 2) {

		result = -ENODEV;

		goto failed;

	}



	result = -EINVAL;

	epd = &iface_desc->endpoint[1].desc;

	if (!usb_endpoint_is_bulk_in(epd))

		goto failed;

	epd = &iface_desc->endpoint[2].desc;

	if (!usb_endpoint_is_bulk_out(epd))

	result = usb_find_common_endpoints(iface_desc, &bulk_in, &bulk_out, NULL, NULL);

	if (result)

		goto failed;



	dev = interface_to_usbdev(interface);
@@ -96,6 +87,8 @@ static int prism2sta_probe_usb(struct usb_interface *interface, 
	}



	/* Initialize the hw data */

	hw->endp_in = usb_rcvbulkpipe(dev, bulk_in->bEndpointAddress);

	hw->endp_out = usb_sndbulkpipe(dev, bulk_out->bEndpointAddress);

	hfa384x_create(hw, dev);

	hw->wlandev = wlandev;

CRA Git | Maintained and supported by SUSTech CRA and CCSE