From patchwork Wed Oct 27 08:08:17 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 12586585 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E3AEFC433EF for ; Wed, 27 Oct 2021 08:12:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D004060F6F for ; Wed, 27 Oct 2021 08:12:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240824AbhJ0IOr (ORCPT ); Wed, 27 Oct 2021 04:14:47 -0400 Received: from mail.kernel.org ([198.145.29.99]:46418 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239185AbhJ0IOn (ORCPT ); Wed, 27 Oct 2021 04:14:43 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 79E26601FF; Wed, 27 Oct 2021 08:12:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1635322338; bh=1yK8f767hVuBik3p0ImJWK6GMwCNwKjgGrhZGPbIhvk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KrO5XD2YIP373HIfFqyTW5p9wJlTqcnDT+cpbR0WBEom7XMLhRnu7COwQgBYkysjK 7hkHhO2v37+Ija7po5YchG8eHKsjZZV/g8HbyPKZlXUn5auD8v76nK/0nGQeEkEZbs v4dwBRwqwXeFCDqNc9tUVUY8/iArvt9u8dXFEI4yVKpbJ823r97mI/lgqamwdWx0dj JKHOnImv33EWEVT4yfZ64qCp9c7lmkLgVH7EGYvOL8oPY4DmxdDApXhk/cW8AfvjPa AG9/IctAFN3pPZI6RBUFAQWhHl6sTc9xk/YMfOXvX6B/cdBOXxfr88lf0msM2+ms8x rLcnMOsARrslg== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1mfe2S-0001lg-Ps; Wed, 27 Oct 2021 10:12:00 +0200 From: Johan Hovold To: Kalle Valo Cc: Amitkumar Karwar , Ganapathi Bhat , Sharvari Harisangam , Xinming Hu , Brian Norris , linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Erik Stromdahl Subject: [PATCH v2 1/3] ath10k: fix division by zero in send path Date: Wed, 27 Oct 2021 10:08:17 +0200 Message-Id: <20211027080819.6675-2-johan@kernel.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20211027080819.6675-1-johan@kernel.org> References: <20211027080819.6675-1-johan@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Add the missing endpoint max-packet sanity check to probe() to avoid division by zero in ath10k_usb_hif_tx_sg() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=0")). Fixes: 4db66499df91 ("ath10k: add initial USB support") Cc: stable@vger.kernel.org # 4.14 Cc: Erik Stromdahl Signed-off-by: Johan Hovold --- drivers/net/wireless/ath/ath10k/usb.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c index 6d831b098cbb..3d98f19c6ec8 100644 --- a/drivers/net/wireless/ath/ath10k/usb.c +++ b/drivers/net/wireless/ath/ath10k/usb.c @@ -853,6 +853,11 @@ static int ath10k_usb_setup_pipe_resources(struct ath10k *ar, le16_to_cpu(endpoint->wMaxPacketSize), endpoint->bInterval); } + + /* Ignore broken descriptors. */ + if (usb_endpoint_maxp(endpoint) == 0) + continue; + urbcount = 0; pipe_num = From patchwork Wed Oct 27 08:08:18 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 12586583 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 728B6C43217 for ; Wed, 27 Oct 2021 08:12:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5CC1A60C40 for ; Wed, 27 Oct 2021 08:12:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240813AbhJ0IOp (ORCPT ); Wed, 27 Oct 2021 04:14:45 -0400 Received: from mail.kernel.org ([198.145.29.99]:46438 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240785AbhJ0IOn (ORCPT ); Wed, 27 Oct 2021 04:14:43 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8D00460F6F; Wed, 27 Oct 2021 08:12:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1635322338; bh=OgMrTYLYFTRq1xURZC/7AxyMSuua7/BgrWAb5qpfMkk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ijLYPecgsamDQTyxBtxqxH85QnhztnkIywWYpFqbyhXWF5Po1XNCMAd/XjnjDo2h4 Tv6wm/p1HabaQ6jCks/VjVHbwE7Ig3WhqwhHaQZPMPI7o43oDFPEGXvOeWtwc6D4dq js+nUhJOcxed14IO0RzP07OjBhwIOsKe/YBvJp/j6nZe7nCq2NKry5WTPCLgzkvwrm pqyrCA/z0ZfpOG4BnlId3tEEauk3/CtQDhcZhAurZLh9RFPnwYqVCJZt+rrsw1OJss oxQO1kTcvz7flPqDc57Q2JfMKPvJYxysdbQaFt+uIhMm7oj78fm9gAksw/AoQDeaSL nAj3VHNmTU54A== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1mfe2S-0001li-Sx; Wed, 27 Oct 2021 10:12:00 +0200 From: Johan Hovold To: Kalle Valo Cc: Amitkumar Karwar , Ganapathi Bhat , Sharvari Harisangam , Xinming Hu , Brian Norris , linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH v2 2/3] ath6kl: fix division by zero in send path Date: Wed, 27 Oct 2021 10:08:18 +0200 Message-Id: <20211027080819.6675-3-johan@kernel.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20211027080819.6675-1-johan@kernel.org> References: <20211027080819.6675-1-johan@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Add the missing endpoint max-packet sanity check to probe() to avoid division by zero in ath10k_usb_hif_tx_sg() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=0")). Fixes: 9cbee358687e ("ath6kl: add full USB support") Cc: stable@vger.kernel.org # 3.5 Signed-off-by: Johan Hovold --- drivers/net/wireless/ath/ath6kl/usb.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c index bd367b79a4d3..aba70f35e574 100644 --- a/drivers/net/wireless/ath/ath6kl/usb.c +++ b/drivers/net/wireless/ath/ath6kl/usb.c @@ -340,6 +340,11 @@ static int ath6kl_usb_setup_pipe_resources(struct ath6kl_usb *ar_usb) le16_to_cpu(endpoint->wMaxPacketSize), endpoint->bInterval); } + + /* Ignore broken descriptors. */ + if (usb_endpoint_maxp(endpoint) == 0) + continue; + urbcount = 0; pipe_num = From patchwork Wed Oct 27 08:08:19 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 12586587 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 62170C433EF for ; Wed, 27 Oct 2021 08:12:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4CB8061090 for ; Wed, 27 Oct 2021 08:12:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240832AbhJ0IOs (ORCPT ); Wed, 27 Oct 2021 04:14:48 -0400 Received: from mail.kernel.org ([198.145.29.99]:46468 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240787AbhJ0IOo (ORCPT ); Wed, 27 Oct 2021 04:14:44 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id E85B1610A5; Wed, 27 Oct 2021 08:12:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1635322339; bh=7IGUs5zBZQaPqlnohFXICy0HDLEn9Ux9E9JxKQ/UU7Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Qg9CRHNl0+/AA6u/+gYSJ9xcpQdAe+BZU+xBdaaByltKipueylMMMXT282EUa6kYl nRHN8PTCFCbqSFGOzz5DbrTnX88zPzV7TaDycbWpIJc4yaJeP+VQzA9XxJzameC/rj Fg9LW+8Ax5oixOQPtMEJ3SaWJKRql2sa02QZMo+mtMQZpTpBcf6K10EREIYHCfuMn2 gr2UoyJjYTKsx0fQHkLduc+nkoHvJqMg4ln3tfAD+w9yVm2+S+UKSAgMUsU+nLaQaI D95ahlTxxOgYpmMRRZSakmel1yIQyJw8LVnvr4/I3iLpnamKYR1Zsap4ChCa+63V7w hjBdL0+VtcoDQ== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1mfe2S-0001lk-Vr; Wed, 27 Oct 2021 10:12:01 +0200 From: Johan Hovold To: Kalle Valo Cc: Amitkumar Karwar , Ganapathi Bhat , Sharvari Harisangam , Xinming Hu , Brian Norris , linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Amitkumar Karwar Subject: [PATCH v2 3/3] mwifiex: fix division by zero in fw download path Date: Wed, 27 Oct 2021 10:08:19 +0200 Message-Id: <20211027080819.6675-4-johan@kernel.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20211027080819.6675-1-johan@kernel.org> References: <20211027080819.6675-1-johan@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Add the missing endpoint sanity checks to probe() to avoid division by zero in mwifiex_write_data_sync() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Only add checks for the firmware-download boot stage, which require both command endpoints, for now. The driver looks like it will handle a missing endpoint during normal operation without oopsing, albeit not very gracefully as it will try to submit URBs to the default pipe and fail. Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=0")). Fixes: 4daffe354366 ("mwifiex: add support for Marvell USB8797 chipset") Cc: stable@vger.kernel.org # 3.5 Cc: Amitkumar Karwar Signed-off-by: Johan Hovold Reviewed-by: Brian Norris --- drivers/net/wireless/marvell/mwifiex/usb.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c index 426e39d4ccf0..9736aa0ab7fd 100644 --- a/drivers/net/wireless/marvell/mwifiex/usb.c +++ b/drivers/net/wireless/marvell/mwifiex/usb.c @@ -505,6 +505,22 @@ static int mwifiex_usb_probe(struct usb_interface *intf, } } + switch (card->usb_boot_state) { + case USB8XXX_FW_DNLD: + /* Reject broken descriptors. */ + if (!card->rx_cmd_ep || !card->tx_cmd_ep) + return -ENODEV; + if (card->bulk_out_maxpktsize == 0) + return -ENODEV; + break; + case USB8XXX_FW_READY: + /* Assume the driver can handle missing endpoints for now. */ + break; + default: + WARN_ON(1); + return -ENODEV; + } + usb_set_intfdata(intf, card); ret = mwifiex_add_card(card, &card->fw_done, &usb_ops,