linux-kernel - [PATCH] char: xillybus: Check endpoint type properly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220514071436.2517776-1-zheyuma97@gmail.com>
Date:   Sat, 14 May 2022 15:14:35 +0800
From:   Zheyu Ma <zheyuma97@...il.com>
To:     eli.billauer@...il.com, arnd@...db.de, gregkh@...uxfoundation.org
Cc:     linux-kernel@...r.kernel.org, Zheyu Ma <zheyuma97@...il.com>
Subject: [PATCH] char: xillybus: Check endpoint type properly

The driver submits bulk urb without checking the endpoint type is
actually bulk.

[    3.108411] ------------[ cut here ]------------
[    3.108690] usb 1-1: BOGUS urb xfer, pipe 3 != type 1
[    3.108983] WARNING: CPU: 0 PID: 211 at drivers/usb/core/urb.c:503 usb_submit_urb+0xcd9/0x18b0
[    3.110976] RIP: 0010:usb_submit_urb+0xcd9/0x18b0
[    3.115318] Call Trace:
[    3.115452]  <TASK>
[    3.115570]  try_queue_bulk_in+0x43c/0x6e0 [xillyusb]
[    3.115838]  xillyusb_probe+0x488/0x1230 [xillyusb]

Add a check to fix it.

Fixes: a53d1202aef1 ("char: xillybus: Add driver for XillyUSB (Xillybus variant for USB)")
Signed-off-by: Zheyu Ma <zheyuma97@...il.com>
---
 drivers/char/xillybus/xillyusb.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/char/xillybus/xillyusb.c b/drivers/char/xillybus/xillyusb.c
index 39bcbfd908b4..2ec2e087b2e7 100644
--- a/drivers/char/xillybus/xillyusb.c
+++ b/drivers/char/xillybus/xillyusb.c
@@ -730,6 +730,11 @@ static void try_queue_bulk_in(struct xillyusb_endpoint *ep)
 
 		usb_anchor_urb(urb, &ep->anchor);
 
+		if (usb_urb_ep_type_check(urb)) {
+			report_io_error(xdev, -EINVAL);
+			goto unanchor;
+		}
+
 		rc = usb_submit_urb(urb, GFP_KERNEL);
 
 		if (rc) {
@@ -834,6 +839,11 @@ static void try_queue_bulk_out(struct xillyusb_endpoint *ep)
 
 		usb_anchor_urb(urb, &ep->anchor);
 
+		if (usb_urb_ep_type_check(urb)) {
+			report_io_error(xdev, -EINVAL);
+			goto unanchor;
+		}
+
 		rc = usb_submit_urb(urb, GFP_KERNEL);
 
 		if (rc) {
-- 
2.25.1