Alan Stern
1bebbd9b80
net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
commit 5e1627cb43 upstream.
The syzbot fuzzer identified a problem in the usbnet driver:
usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 0 PID: 754 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504
Modules linked in:
CPU: 0 PID: 754 Comm: kworker/0:2 Not tainted 6.4.0-rc7-syzkaller-00014-g692b7dc87ca6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
Workqueue: mld mld_ifc_work
RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504
Code: 7c 24 18 e8 2c b4 5b fb 48 8b 7c 24 18 e8 42 07 f0 fe 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 c9 fc 8a e8 5a 6f 23 fb <0f> 0b e9 58 f8 ff ff e8 fe b3 5b fb 48 81 c5 c0 05 00 00 e9 84 f7
RSP: 0018:ffffc9000463f568 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffff88801eb28000 RSI: ffffffff814c03b7 RDI: 0000000000000001
RBP: ffff8881443b7190 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000003
R13: ffff88802a77cb18 R14: 0000000000000003 R15: ffff888018262500
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556a99c15a18 CR3: 0000000028c71000 CR4: 0000000000350ef0
Call Trace:
<TASK>
usbnet_start_xmit+0xfe5/0x2190 drivers/net/usb/usbnet.c:1453
__netdev_start_xmit include/linux/netdevice.h:4918 [inline]
netdev_start_xmit include/linux/netdevice.h:4932 [inline]
xmit_one net/core/dev.c:3578 [inline]
dev_hard_start_xmit+0x187/0x700 net/core/dev.c:3594
...
This bug is caused by the fact that usbnet trusts the bulk endpoint
addresses its probe routine receives in the driver_info structure, and
it does not check to see that these endpoints actually exist and have
the expected type and directions.
The fix is simply to add such a check.
Reported-and-tested-by: syzbot+63ee658b9a100ffadbe2@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/000000000000a56e9105d0cec021@google.com/
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: Oliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/ea152b6d-44df-4f8a-95c6-4db51143dcc1@rowland.harvard.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-08-11 12:08:24 +02:00
..
2023-01-24 07:24:37 +01:00
2023-08-03 10:24:18 +02:00
2023-05-30 14:03:19 +01:00
2023-08-03 10:24:07 +02:00
2023-03-30 12:49:09 +02:00
2023-03-11 13:55:16 +01:00
2023-08-08 20:03:50 +02:00
2022-10-12 10:23:24 -07:00
2023-08-11 12:08:21 +02:00
2023-06-14 11:15:28 +02:00
2023-07-23 13:49:43 +02:00
2023-08-03 10:24:14 +02:00
2023-08-11 12:08:22 +02:00
2023-07-19 16:20:59 +02:00
2023-01-24 07:24:35 +01:00
2023-04-13 16:55:31 +02:00
2023-08-03 10:24:18 +02:00
2023-05-11 23:03:04 +09:00
2023-07-19 16:21:42 +02:00
2023-08-03 10:24:04 +02:00
2023-07-19 16:21:43 +02:00
2023-01-07 11:11:40 +01:00
2022-12-31 13:32:38 +01:00
2023-06-09 10:34:00 +02:00
2023-08-03 10:24:19 +02:00
2023-06-21 16:00:51 +02:00
2023-07-19 16:22:08 +02:00
2023-02-09 11:27:59 +01:00
2023-08-11 12:08:19 +02:00
2023-05-11 23:03:27 +09:00
2023-02-09 11:28:04 +01:00
2023-08-03 10:23:49 +02:00
2023-08-11 12:08:22 +02:00
2023-07-27 08:50:32 +02:00
2022-12-31 13:32:45 +01:00
2023-05-11 23:03:38 +09:00
2023-06-28 11:12:23 +02:00
2023-08-03 10:24:12 +02:00
2023-07-19 16:21:58 +02:00
2023-08-03 10:23:50 +02:00
2023-07-19 16:21:54 +02:00
2023-04-06 12:10:58 +02:00
2023-07-23 13:49:42 +02:00
2023-08-03 10:24:06 +02:00
2023-07-19 16:21:26 +02:00
2023-05-11 23:03:28 +09:00
2023-08-11 12:08:09 +02:00
2022-10-08 08:56:37 -07:00
2023-08-03 10:24:14 +02:00
2023-08-11 12:08:13 +02:00
2023-07-19 16:22:15 +02:00
2023-05-11 23:03:31 +09:00
2023-07-19 16:22:03 +02:00
2023-05-24 17:32:41 +01:00
2023-08-03 10:24:17 +02:00
2023-08-03 10:23:57 +02:00
2023-07-19 16:21:24 +02:00
2023-07-19 16:21:08 +02:00
2023-05-24 17:32:37 +01:00
2023-07-23 13:49:37 +02:00
2023-07-23 13:49:37 +02:00
2023-07-19 16:22:09 +02:00
2023-08-11 12:08:20 +02:00
2023-08-11 12:08:24 +02:00
2023-06-28 11:12:36 +02:00
2023-07-23 13:49:24 +02:00
2023-07-05 18:27:37 +01:00
2023-03-10 09:34:20 +01:00
2023-07-23 13:49:43 +02:00
2023-07-19 16:21:57 +02:00
2023-07-27 08:50:26 +02:00
2023-07-23 13:49:42 +02:00
2023-05-24 17:32:42 +01:00
2022-11-09 15:40:32 +01:00
2023-08-03 10:23:51 +02:00
2023-07-23 13:49:44 +02:00
2023-08-03 10:23:59 +02:00
2023-07-27 08:50:38 +02:00
2023-08-03 10:24:01 +02:00
2022-12-31 13:31:56 +01:00
2023-06-21 16:00:52 +02:00
2023-07-19 16:21:00 +02:00
2023-04-06 12:10:44 +02:00
2023-07-23 13:49:46 +02:00
2022-12-31 13:32:00 +01:00
2023-07-19 16:22:14 +02:00
2023-05-24 17:32:53 +01:00
2023-02-01 08:34:05 +01:00
2023-05-11 23:03:16 +09:00
2023-07-19 16:21:59 +02:00
2023-08-11 12:08:19 +02:00
2023-08-11 12:08:19 +02:00
2022-11-09 15:40:14 +01:00
2022-11-10 18:45:40 +01:00
2023-07-23 13:49:34 +02:00
2023-08-03 10:24:15 +02:00
2023-07-27 08:50:50 +02:00
2023-05-11 23:03:31 +09:00
2023-08-03 10:24:12 +02:00
2023-06-28 11:12:35 +02:00
2023-06-14 11:15:28 +02:00
2023-07-19 16:21:01 +02:00
2023-06-21 16:00:56 +02:00
2023-08-03 10:24:12 +02:00
2023-07-23 13:49:21 +02:00
2022-12-31 13:32:38 +01:00
2023-08-03 10:24:12 +02:00
2023-06-14 11:15:32 +02:00
2023-07-19 16:21:41 +02:00
2023-06-28 11:12:40 +02:00
2023-07-27 08:50:45 +02:00
2023-07-19 16:20:55 +02:00
2023-05-11 23:03:31 +09:00
2023-07-19 16:21:48 +02:00
2023-06-09 10:34:07 +02:00
2023-08-03 10:24:14 +02:00