Pavel Skripkin
cbd110b8dd
can: mcba_usb: properly check endpoint type ...
commit 136bed0bfd3bc9c95c88aafff2d22ecb3a919f23 upstream.
Syzbot reported warning in usb_submit_urb() which is caused by wrong
endpoint type. We should check that in endpoint is actually present to
prevent this warning.
Found pipes are now saved to struct mcba_priv and code uses them
directly instead of making pipes in place.
Fail log:
| usb 5-1: BOGUS urb xfer, pipe 3 != type 1
| WARNING: CPU: 1 PID: 49 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502
| Modules linked in:
| CPU: 1 PID: 49 Comm: kworker/1:2 Not tainted 5.17.0-rc6-syzkaller-00184-g38f80f42147f #0
| Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
| Workqueue: usb_hub_wq hub_event
| RIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502
| ...
| Call Trace:
| <TASK>
| mcba_usb_start drivers/net/can/usb/mcba_usb.c:662 [inline]
| mcba_usb_probe+0x8a3/0xc50 drivers/net/can/usb/mcba_usb.c:858
| usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396
| call_driver_probe drivers/base/dd.c:517 [inline]
Fixes: 51f3baad7dhttps://lore.kernel.org/all/20220313100903.10868-1-paskripkin@gmail.com
Reported-and-tested-by: syzbot+3bc1dce0cc0052d60fde@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-04-15 14:18:28 +02:00
ACPI/APEI: Limit printable size of BERT table data
2022-04-15 14:18:23 +02:00
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
2021-11-06 13:59:45 +01:00
binder: fix handling of error during copy
2022-01-27 09:19:38 +01:00
ata: pata_hpt37x: fix PCI clock detection
2022-03-08 19:07:46 +01:00
atm: eni: Add check for dma_map_single
2022-03-23 09:12:07 +01:00
auxdisplay: ht16k33: Fix frame buffer device blanking
2021-11-17 09:48:45 +01:00
PM: core: keep irq flags in device_pm_check_callbacks()
2022-04-15 14:18:23 +02:00
loop: use sysfs_emit() in the sysfs xxx show()
2022-04-15 14:18:22 +02:00
Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt
2022-04-15 14:18:16 +02:00
bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
2021-10-13 10:08:19 +02:00
hwrng: atmel - disable trng on failure path
2022-04-15 14:18:05 +02:00
clk: Initialize orphan req_rate
2022-04-15 14:18:21 +02:00
clocksource: acpi_pm: fix return value of __setup handler
2022-04-15 14:18:05 +02:00
cpufreq: Fix initialization of min and max frequency QoS requests
2022-01-27 09:19:44 +01:00
cpuidle: Fix kobject memory leaks in error paths
2021-11-17 09:48:36 +01:00
crypto: ccp - ccp_dmaengine_unregister release dma channels
2022-04-15 14:18:05 +02:00
dax: make sure inodes are flushed before destroy cache
2022-04-15 14:18:12 +02:00
dmaengine: shdma: Fix runtime PM imbalance on error
2022-03-08 19:07:45 +01:00
udmabuf: validate ubuf->pagecount
2022-04-15 14:18:10 +02:00
EDAC: Fix calculation of returned address and next offset in edac_align_ptr()
2022-02-23 11:59:59 +01:00
firmware: google: Properly state IOMEM dependency
2022-04-15 14:18:20 +02:00
fpga: machxo2-spi: Fix missing error code in machxo2_write_complete()
2021-09-30 10:09:23 +02:00
gpio: ts4900: Do not set DAT and OE together
2022-03-16 13:21:46 +01:00
drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt
2022-04-15 14:18:14 +02:00
greybus: svc: fix an error handling bug in gb_svc_hello()
2022-04-15 14:17:58 +02:00
HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
2022-04-15 14:18:12 +02:00
HSI: core: Fix return freed object in hsi_new_client
2022-01-27 09:19:41 +01:00
hv_balloon: rate-limit "Unhandled message" warning
2022-04-15 14:18:15 +02:00
hwmon: (pmbus) Add Vin unit off handling
2022-04-15 14:18:05 +02:00
coresight: Fix TRCCONFIGR.QE sysfs interface
2022-04-15 14:17:57 +02:00
i2c: mux: demux-pinctrl: do not deactivate a master that is not active
2022-04-15 14:18:16 +02:00
iio: adc: Add check for devm_request_threaded_irq
2022-04-15 14:18:18 +02:00
RDMA/mlx5: Fix memory leak in error flow for subscribe event routine
2022-04-15 14:18:16 +02:00
Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
2022-04-15 14:18:00 +02:00
iommu/ipmmu-vmsa: Check for error num after setting mask
2022-04-15 14:18:12 +02:00
ipack: ipoctal: fix module reference leak
2021-10-06 15:42:36 +02:00
irqchip/nvic: Release nvic_base upon failure
2022-04-15 14:18:22 +02:00
mISDN: change function names to avoid conflicts
2022-01-11 15:23:33 +01:00
mailbox: tegra-hsp: Flush whole channel
2022-04-15 14:18:01 +02:00
mcb: fix error handling in mcb_alloc_bus()
2021-09-30 10:09:22 +02:00
dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS
2022-04-15 14:18:13 +02:00
media: hdpvr: initialize dev->worker at hdpvr_register_videodev
2022-04-15 14:18:25 +02:00
memory: emif: check the pointer temp in get_device_details()
2022-04-15 14:18:09 +02:00
memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
2021-11-17 09:48:37 +01:00
mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
2022-04-15 14:18:17 +02:00
kgdbts: fix return value of __setup handler
2022-04-15 14:18:20 +02:00
mmc: host: Return an error when ->enable_sdio_irq() ops is missing
2022-04-15 14:18:25 +02:00
mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
2022-04-15 14:18:16 +02:00
can: mcba_usb: properly check endpoint type
2022-04-15 14:18:28 +02:00
nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
2022-03-28 08:46:43 +02:00
libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind
2021-10-06 15:42:38 +02:00
nvme-rdma: fix possible use-after-free in transport error_recovery work
2022-02-23 11:59:56 +01:00
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
2021-10-20 11:40:14 +02:00
of: base: Improve argument length mismatch error
2022-01-27 09:19:51 +01:00
opp: Fix return in _opp_add_static_v2()
2021-11-17 09:48:44 +01:00
parisc: Fix sglist access in ccio-dma.c
2022-02-23 11:59:54 +01:00
PCI: Reduce warnings on possible RW1C corruption
2022-04-15 14:18:15 +02:00
pcmcia: fix setting of kthread task states
2022-01-27 09:19:37 +01:00
phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure})
2022-04-15 14:18:18 +02:00
pinctrl: npcm: Fix broken references to chip->parent_device
2022-04-15 14:18:22 +02:00
platform/x86: ISST: Fix possible circular locking dependency detected
2022-02-23 11:59:55 +01:00
power: supply: wm8350-power: Add missing free in free_charger_irq
2022-04-15 14:18:15 +02:00
ptp_pch: Load module automatically if ID matches
2021-10-13 10:08:19 +02:00
pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add()
2022-04-15 14:18:17 +02:00
regulator: qcom_smd: fix for_each_child.cocci warnings
2022-04-15 14:18:04 +02:00
remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region
2022-04-15 14:18:19 +02:00
reset: socfpga: add empty driver allowing consumers to probe
2021-11-17 09:48:20 +01:00
rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev
2022-02-01 17:24:36 +01:00
rtc: cmos: Evaluate century appropriate
2022-02-08 18:24:34 +01:00
scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices
2022-02-01 17:24:33 +01:00
scsi: qla2xxx: Use correct feature type field during RFF_ID processing
2022-04-15 14:18:27 +02:00
maple: fix wrong return value of maple_bus_init().
2021-11-26 10:47:17 +01:00
soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
2022-04-15 14:18:07 +02:00
spi: tegra20: Use of_device_get_match_data()
2022-04-15 14:18:23 +02:00
staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree
2022-04-15 14:18:19 +02:00
scsi: target: iscsi: Make sure the np under each tpg is unique
2022-02-16 12:52:48 +01:00
optee: use driver internal tee_context for some rpc
2022-03-02 11:41:04 +01:00
thermal: int340x: Increase bitmap size
2022-04-15 14:18:02 +02:00
kgdboc: fix return value of __setup handler
2022-04-15 14:18:20 +02:00
USB: storage: ums-realtek: fix error code in rts51x_read_mem()
2022-04-15 14:18:16 +02:00
vhost/vsock: don't check owner in vhost_vsock_stop() while releasing
2022-03-02 11:41:00 +01:00
video: fbdev: sm712fb: Fix crash in smtcfb_write()
2022-04-15 14:18:25 +02:00
virtio: acknowledge all features before access
2022-03-16 13:21:48 +01:00
w1: Misuse of get_user()/put_user() reported by sparse
2022-01-27 09:19:48 +01:00
ar7: fix kernel builds for compiler test
2021-11-17 09:48:46 +01:00
xen/gnttab: fix gnttab_end_foreign_access() without page specified
2022-03-11 11:22:39 +01:00
cbd110b8dd