As syzkaller detected, wlan-ng driver does not do sanity check of
endpoints in prism2sta_probe_usb(), add check for xfer direction and type

Reported-and-tested-by: syzbot+c2a1fa67c02faa0de...@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=c2a1fa67c02faa0de723
Signed-off-by: Rustam Kovhaev <rkovh...@gmail.com>
---
 drivers/staging/wlan-ng/prism2usb.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/wlan-ng/prism2usb.c 
b/drivers/staging/wlan-ng/prism2usb.c
index 4689b2170e4f..456603fd26c0 100644
--- a/drivers/staging/wlan-ng/prism2usb.c
+++ b/drivers/staging/wlan-ng/prism2usb.c
@@ -61,11 +61,25 @@ static int prism2sta_probe_usb(struct usb_interface 
*interface,
                               const struct usb_device_id *id)
 {
        struct usb_device *dev;
-
+       const struct usb_endpoint_descriptor *epd;
+       const struct usb_host_interface *iface_desc = interface->cur_altsetting;
        struct wlandevice *wlandev = NULL;
        struct hfa384x *hw = NULL;
        int result = 0;
 
+       if (iface_desc->desc.bNumEndpoints != 2) {
+               result = -ENODEV;
+               goto failed;
+       }
+
+       result = -EINVAL;
+       epd = &iface_desc->endpoint[1].desc;
+       if (!usb_endpoint_is_bulk_in(epd))
+               goto failed;
+       epd = &iface_desc->endpoint[2].desc;
+       if (!usb_endpoint_is_bulk_out(epd))
+               goto failed;
+
        dev = interface_to_usbdev(interface);
        wlandev = create_wlan();
        if (!wlandev) {
-- 
2.27.0

_______________________________________________
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

Reply via email to