Fedor Pchelkin
ca57748593
wifi: ath9k: verify the expected usb_endpoints are present ...
[ Upstream commit 16ef02bad239f11f322df8425d302be62f0443ce ]
The bug arises when a USB device claims to be an ATH9K but doesn't
have the expected endpoints. (In this case there was an interrupt
endpoint where the driver expected a bulk endpoint.) The kernel
needs to be able to handle such devices without getting an internal error.
usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 3 PID: 500 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493
Modules linked in:
CPU: 3 PID: 500 Comm: kworker/3:2 Not tainted 5.10.135-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: events request_firmware_work_func
RIP: 0010:usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493
Call Trace:
ath9k_hif_usb_alloc_rx_urbs drivers/net/wireless/ath/ath9k/hif_usb.c:908 [inline]
ath9k_hif_usb_alloc_urbs+0x75e/0x1010 drivers/net/wireless/ath/ath9k/hif_usb.c:1019
ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1109 [inline]
ath9k_hif_usb_firmware_cb+0x142/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1242
request_firmware_work_func+0x12e/0x240 drivers/base/firmware_loader/main.c:1097
process_one_work+0x9af/0x1600 kernel/workqueue.c:2279
worker_thread+0x61d/0x12f0 kernel/workqueue.c:2425
kthread+0x3b4/0x4a0 kernel/kthread.c:313
ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20221008211532.74583-1-pchelkin@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-01-18 11:41:35 +01:00
ACPICA: Fix error code path in acpi_ds_call_control_method()
2023-01-18 11:41:34 +01:00
binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
2022-12-08 11:23:01 +01:00
pata_ipx4xx_cf: Fix unsigned comparison with less than zero
2023-01-18 11:40:59 +01:00
class: fix possible memory leak in __class_register()
2023-01-18 11:41:21 +01:00
drbd: use after free in drbd_create_device()
2022-11-25 17:42:16 +01:00
Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
2023-01-18 11:41:16 +01:00
bus: sunxi-rsb: Support atomic transfers
2022-12-08 11:22:57 +01:00
hwrng: geode - Fix PCI device refcount leak
2023-01-18 11:41:21 +01:00
clk: socfpga: Fix memory leak in socfpga_gate_init()
2023-01-18 11:41:13 +01:00
clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled
2023-01-18 11:40:56 +01:00
counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update
2023-01-18 11:41:24 +01:00
cpufreq: amd_freq_sensitivity: Add missing pci_dev_put()
2023-01-18 11:40:55 +01:00
cpuidle: dt: Return the correct numbers of parsed idle states
2023-01-18 11:40:53 +01:00
crypto: img-hash - Fix variable dereferenced before check 'hdev->req'
2023-01-18 11:41:21 +01:00
drivers: dio: fix possible memory leak in dio_init()
2023-01-18 11:41:21 +01:00
EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
2023-01-18 11:40:55 +01:00
firmware: coreboot: Register bus in module init
2022-12-08 11:23:00 +01:00
gpio: amd8111: Fix PCI device reference count leak
2022-12-14 11:30:44 +01:00
drm/etnaviv: add missing quirks for GC300
2023-01-18 11:41:34 +01:00
HID: hid-sensor-custom: set fixed size for custom attributes
2023-01-18 11:41:04 +01:00
HSI: omap_ssi_core: Fix error handling in ssi_init()
2023-01-18 11:41:28 +01:00
Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
2022-12-08 11:22:58 +01:00
hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
2022-12-08 11:23:03 +01:00
i2c: ismt: Fix an out-of-bounds bug in ismt_access()
2023-01-18 11:41:26 +01:00
iio: light: rpr0521: add missing Kconfig dependencies
2022-12-08 11:23:02 +01:00
RDMA/siw: Fix pointer cast warning
2023-01-18 11:41:29 +01:00
Input: elants_i2c - properly handle the reset GPIO when power is off
2023-01-18 11:41:03 +01:00
iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe()
2023-01-18 11:41:29 +01:00
irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe()
2023-01-18 11:40:54 +01:00
mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
2023-01-18 11:41:32 +01:00
macintosh/macio-adb: check the return value of ioremap()
2023-01-18 11:41:29 +01:00
mailbox: zynq-ipi: fix error handling while device_register() fails
2023-01-18 11:41:33 +01:00
mcb: mcb-parse: fix error handing in chameleon_parse_gdd()
2023-01-18 11:41:25 +01:00
dm integrity: flush the journal on suspend
2022-12-08 11:23:01 +01:00
media: coda: Add check for kmalloc
2023-01-18 11:41:12 +01:00
cxl: Fix refcount leak in cxl_calc_capp_routing
2023-01-18 11:41:30 +01:00
mmc: mmci: fix return value check of mmc_add_host()
2023-01-18 11:41:11 +01:00
mtd: maps: pxa2xx-flash: fix memory leak in probe
2023-01-18 11:41:05 +01:00
wifi: ath9k: verify the expected usb_endpoints are present
2023-01-18 11:41:35 +01:00
nfc: pn533: Clear nfc_target before being used
2023-01-18 11:41:32 +01:00
nvme initialize core quirks before calling nvme_init_subsystem
2022-12-14 11:30:46 +01:00
of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()
2023-01-18 11:41:14 +01:00
PCI: Check for alloc failure in pci_request_irq()
2023-01-18 11:41:18 +01:00
perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
2023-01-18 11:40:50 +01:00
pinctrl: pinconf-generic: add missing of_node_put()
2023-01-18 11:41:06 +01:00
platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
2023-01-18 11:40:58 +01:00
PNP: fix name memory leak in pnp_alloc_dev()
2023-01-18 11:40:54 +01:00
power: supply: fix null pointer dereferencing in power_supply_get_battery_info
2023-01-18 11:41:28 +01:00
pwm: sifive: Call pwm_sifive_update_clock() while mutex is held
2023-01-18 11:41:30 +01:00
rapidio: devices: fix missing put_device in mport_cdev_open
2023-01-18 11:40:59 +01:00
regulator: core: fix resource leak in regulator_register()
2023-01-18 11:41:09 +01:00
remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region()
2023-01-18 11:41:31 +01:00
rtc: mxc_v2: Add missing clk_disable_unprepare()
2023-01-18 11:41:32 +01:00
s390/dasd: fix no record found for raw_track_access
2022-12-08 11:22:59 +01:00
scsi: snic: Fix possible UAF in snic_tgt_create()
2023-01-18 11:41:20 +01:00
slimbus: stream: correct presence rate frequencies
2022-11-25 17:42:17 +01:00
soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe
2023-01-18 11:40:50 +01:00
spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode
2023-01-18 11:41:12 +01:00
staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor()
2023-01-18 11:41:25 +01:00
scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()
2022-11-25 17:42:20 +01:00
tee: optee: fix possible memory leak in optee_register_device()
2022-12-08 11:22:57 +01:00
serial: sunsab: Fix error handling in sunsab_init()
2023-01-18 11:41:23 +01:00
uio: uio_dmem_genirq: Fix deadlock between irq config and handling
2023-01-18 11:41:22 +01:00
usb: storage: Add check for kcalloc
2023-01-18 11:41:26 +01:00
vfio: platform: Do not pass return buffer to ACPI _RST method
2023-01-18 11:41:22 +01:00
fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()
2023-01-18 11:41:27 +01:00
vme: Fix error not catched in fake_init()
2023-01-18 11:41:26 +01:00
xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()
2023-01-18 11:40:57 +01:00
ca57748593