lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <YwyaeNX2vYcHttfU@kroah.com>
Date:   Mon, 29 Aug 2022 12:52:40 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Mazin Al Haddad <mazinalhaddad05@...il.com>
Cc:     pontus.fuchs@...il.com, netdev@...r.kernel.org, kvalo@...nel.org,
        linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org,
        edumazet@...gle.com,
        syzbot+1bc2c2afd44f820a669f@...kaller.appspotmail.com,
        kuba@...nel.org, pabeni@...hat.com,
        linux-kernel-mentees@...ts.linuxfoundation.org, davem@...emloft.net
Subject: Re: [PATCH v3] ar5523: check endpoints type and direction in probe()

On Sat, Aug 27, 2022 at 02:01:49PM +0300, Mazin Al Haddad wrote:
> Fixes a bug reported by syzbot, where a warning occurs in usb_submit_urb()
> due to the wrong endpoint type. There is no check for both the number
> of endpoints and the type.
> 
> Fix it by adding a check for the number of endpoints and the
> direction/type of the endpoints. If the endpoints do not match -ENODEV is
> returned.
> 
> usb 1-1: BOGUS urb xfer, pipe 3 != type 1
> WARNING: CPU: 1 PID: 71 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502
> Modules linked in:
> CPU: 1 PID: 71 Comm: kworker/1:2 Not tainted 5.19.0-rc7-syzkaller-00150-g32f02a211b0a #0
> Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
> Workqueue: usb_hub_wq hub_event
> Call Trace:
>  <TASK>
>  ar5523_cmd+0x420/0x790 drivers/net/wireless/ath/ar5523/ar5523.c:275
>  ar5523_cmd_read drivers/net/wireless/ath/ar5523/ar5523.c:302 [inline]
>  ar5523_host_available drivers/net/wireless/ath/ar5523/ar5523.c:1376 [inline]
>  ar5523_probe+0xc66/0x1da0 drivers/net/wireless/ath/ar5523/ar5523.c:1655
> 
> Link: https://syzkaller.appspot.com/bug?extid=1bc2c2afd44f820a669f
> Reported-and-tested-by: syzbot+1bc2c2afd44f820a669f@...kaller.appspotmail.com
> Signed-off-by: Mazin Al Haddad <mazinalhaddad05@...il.com>
> ---
> v2->v3 changes:
>  - Make use of helper functions instead of checking for direction
> 	 and type manually. 
> 
>  drivers/net/wireless/ath/ar5523/ar5523.c | 38 ++++++++++++++++++++++++
>  1 file changed, 38 insertions(+)
> 
> diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
> index 6f937d2cc126..69979e8f99fd 100644
> --- a/drivers/net/wireless/ath/ar5523/ar5523.c
> +++ b/drivers/net/wireless/ath/ar5523/ar5523.c
> @@ -1581,8 +1581,46 @@ static int ar5523_probe(struct usb_interface *intf,
>  	struct usb_device *dev = interface_to_usbdev(intf);
>  	struct ieee80211_hw *hw;
>  	struct ar5523 *ar;
> +	struct usb_host_interface *host = intf->cur_altsetting;
> +	struct usb_endpoint_descriptor *cmd_tx, *cmd_rx, *data_tx, *data_rx;
>  	int error = -ENOMEM;
>  
> +	if (host->desc.bNumEndpoints != 4) {
> +		dev_err(&dev->dev, "Wrong number of endpoints\n");
> +		return -ENODEV;
> +	}
> +
> +	for (int i = 0; i < host->desc.bNumEndpoints; ++i) {
> +		struct usb_endpoint_descriptor *ep = &host->endpoint[i].desc;
> +
> +		if (usb_endpoint_is_bulk_out(ep)) {
> +			if (!cmd_tx) {
> +				if (ep->bEndpointAddress == AR5523_CMD_TX_PIPE)
> +					cmd_tx = ep;
> +			}
> +			if (!data_tx) {
> +				if (ep->bEndpointAddress == AR5523_DATA_TX_PIPE)
> +					data_tx = ep;
> +				}
> +		}
> +
> +		if (usb_endpoint_is_bulk_in(ep)) {
> +			if (!cmd_rx) {
> +				if (ep->bEndpointAddress == AR5523_CMD_RX_PIPE)
> +					cmd_rx = ep;
> +			}
> +			if (!data_rx) {
> +				if (ep->bEndpointAddress == AR5523_DATA_RX_PIPE)
> +					data_rx = ep;
> +			}
> +		}
> +	}
> +
> +	if (!cmd_tx || !data_tx || !cmd_rx || !data_rx) {
> +		dev_warn("wrong number of endpoints\n");
> +		return -ENODEV;
> +	}

So you save off all of these values, and then do not use them anywhere?
Why not properly save them to the device structure and then you can get
rid of the odd ar5523_cmd_tx_pipe() macros?

Also, I don't see why you can't use the USB core function for finding
endpoints, all you want is the first 2 bulk in and 2 bulk out, that
should be much simpler to use than the above long codebase.

thanks,

greg k-h

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ