redonkable
/
remarkable-linux
1
0
Fork 0
Code Releases Activity
remarkable-linux/drivers/uwb
History
Andrey Konovalov 8928c5b2d3 uwb: ensure that endpoint is interrupt 
commit 70e743e4ce upstream.

hwarc_neep_init() assumes that endpoint 0 is interrupt, but there's no
check for that, which results in a WARNING in USB core code, when a bad
USB descriptor is provided from a device:

usb 1-1: BOGUS urb xfer, pipe 1 != type 3
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3 at drivers/usb/core/urb.c:449 usb_submit_urb+0xf8a/0x11d0
Modules linked in:
CPU: 0 PID: 3 Comm: kworker/0:0 Not tainted 4.13.0+ #111
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: usb_hub_wq hub_event
task: ffff88006bdc1a00 task.stack: ffff88006bde8000
RIP: 0010:usb_submit_urb+0xf8a/0x11d0 drivers/usb/core/urb.c:448
RSP: 0018:ffff88006bdee3c0 EFLAGS: 00010282
RAX: 0000000000000029 RBX: ffff8800672a7200 RCX: 0000000000000000
RDX: 0000000000000029 RSI: ffff88006c815c78 RDI: ffffed000d7bdc6a
RBP: ffff88006bdee4c0 R08: fffffbfff0fe00ff R09: fffffbfff0fe00ff
R10: 0000000000000018 R11: fffffbfff0fe00fe R12: 1ffff1000d7bdc7f
R13: 0000000000000003 R14: 0000000000000001 R15: ffff88006b02cc90
FS:  0000000000000000(0000) GS:ffff88006c800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe4daddf000 CR3: 000000006add6000 CR4: 00000000000006f0
Call Trace:
 hwarc_neep_init+0x4ce/0x9c0 drivers/uwb/hwa-rc.c:710
 uwb_rc_add+0x2fb/0x730 drivers/uwb/lc-rc.c:361
 hwarc_probe+0x34e/0x9b0 drivers/uwb/hwa-rc.c:858
 usb_probe_interface+0x351/0x8d0 drivers/usb/core/driver.c:361
 really_probe drivers/base/dd.c:385
 driver_probe_device+0x610/0xa00 drivers/base/dd.c:529
 __device_attach_driver+0x230/0x290 drivers/base/dd.c:625
 bus_for_each_drv+0x15e/0x210 drivers/base/bus.c:463
 __device_attach+0x269/0x3c0 drivers/base/dd.c:682
 device_initial_probe+0x1f/0x30 drivers/base/dd.c:729
 bus_probe_device+0x1da/0x280 drivers/base/bus.c:523
 device_add+0xcf9/0x1640 drivers/base/core.c:1703
 usb_set_configuration+0x1064/0x1890 drivers/usb/core/message.c:1932
 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174
 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266
 really_probe drivers/base/dd.c:385
 driver_probe_device+0x610/0xa00 drivers/base/dd.c:529
 __device_attach_driver+0x230/0x290 drivers/base/dd.c:625
 bus_for_each_drv+0x15e/0x210 drivers/base/bus.c:463
 __device_attach+0x269/0x3c0 drivers/base/dd.c:682
 device_initial_probe+0x1f/0x30 drivers/base/dd.c:729
 bus_probe_device+0x1da/0x280 drivers/base/bus.c:523
 device_add+0xcf9/0x1640 drivers/base/core.c:1703
 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457
 hub_port_connect drivers/usb/core/hub.c:4890
 hub_port_connect_change drivers/usb/core/hub.c:4996
 port_event drivers/usb/core/hub.c:5102
 hub_event+0x23c8/0x37c0 drivers/usb/core/hub.c:5182
 process_one_work+0x9fb/0x1570 kernel/workqueue.c:2097
 worker_thread+0x1e4/0x1350 kernel/workqueue.c:2231
 kthread+0x324/0x3f0 kernel/kthread.c:231
 ret_from_fork+0x25/0x30 arch/x86/entry/entry_64.S:425
Code: 48 8b 85 30 ff ff ff 48 8d b8 98 00 00 00 e8 8e 93 07 ff 45 89
e8 44 89 f1 4c 89 fa 48 89 c6 48 c7 c7 a0 e5 55 86 e8 20 08 8f fd <0f>
ff e9 9b f7 ff ff e8 4a 04 d6 fd e9 80 f7 ff ff e8 60 11 a6
---[ end trace 55d741234124cfc3 ]---

Check that endpoint is interrupt.

Found by syzkaller.

Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2017-10-12 11:51:19 +02:00
..
i1480 uwb: fix device quirk on big-endian hosts 2017-05-25 15:44:46 +02:00
Kconfig uwb: remove UWB build dependency on PCI 2014-09-23 22:04:44 -07:00
Makefile
…
address.c
…
allocator.c uwb: use for_each_clear_bit() 2012-03-23 16:58:34 -07:00
beacon.c uwb: fix variable set but not used warnings 2014-05-27 15:18:48 -07:00
driver.c uwb: create a uwb bus type and add in-range peer devices to it 2014-09-23 22:04:44 -07:00
drp-avail.c
…
drp-ie.c uwb: Staticize local symbols 2013-08-19 17:08:16 -07:00
drp.c uwb: drp: Use setup_timer 2015-10-24 19:52:53 -07:00
est.c uwb: fix variable set but not used warnings 2014-05-27 15:18:48 -07:00
hwa-rc.c uwb: ensure that endpoint is interrupt 2017-10-12 11:51:19 +02:00
ie-rcv.c uwb: fix variable set but not used warnings 2014-05-27 15:18:48 -07:00
ie.c uwb: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required 2011-10-31 19:32:19 -04:00
lc-dev.c uwb: lc-dev: Remove unused function 2015-01-25 20:48:28 +08:00
lc-rc.c uwb: fix device reference leaks 2016-11-01 09:04:04 -06:00
neh.c uwb: neh: Use setup_timer 2015-10-24 19:52:53 -07:00
pal.c uwb: fix device reference leaks 2016-11-01 09:04:04 -06:00
radio.c uwb: comment typo fix 2014-05-27 15:18:48 -07:00
reset.c uwb: fix uwb_dev_unlock() missed at an error path in uwb_rc_cmd_async() 2012-11-26 15:58:43 -08:00
rsv.c uwb: rsv: Use setup_timer 2015-10-24 19:52:53 -07:00
scan.c drivers/uwb: fix implicit use of stat.h 2011-10-31 19:32:18 -04:00
umc-bus.c uwb: Remove umc bus legacy suspend/resume support 2015-03-18 17:27:03 +01:00
umc-dev.c uwb: umc-dev: add missing put_device call 2013-12-19 10:26:46 -08:00
umc-drv.c uwb: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required 2011-10-31 19:32:19 -04:00
uwb-debug.c debugfs: Pass bool pointer to debugfs_create_bool() 2015-10-04 11:36:07 +01:00
uwb-internal.h uwb: create a uwb bus type and add in-range peer devices to it 2014-09-23 22:04:44 -07:00
uwbd.c uwb: properly check kthread_run return value 2017-10-12 11:51:19 +02:00
whc-rc.c
…
whci.c uwb/whci: Delete an unnecessary check before the function call "umc_device_unregister" 2015-03-18 16:56:40 +01:00