superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
mirror-linux/drivers/net/usb
History
Nikita Zhandarovich 1cf9631d83 usbnet: gl620a: fix endpoint checking in genelink_bind() 
Syzbot reports [1] a warning in usb_submit_urb() triggered by
inconsistencies between expected and actually present endpoints
in gl620a driver. Since genelink_bind() does not properly
verify whether specified eps are in fact provided by the device,
in this case, an artificially manufactured one, one may get a
mismatch.

Fix the issue by resorting to a usbnet utility function
usbnet_get_endpoints(), usually reserved for this very problem.
Check for endpoints and return early before proceeding further if
any are missing.

[1] Syzbot report:
usb 5-1: Manufacturer: syz
usb 5-1: SerialNumber: syz
usb 5-1: config 0 descriptor??
gl620a 5-1:0.23 usb0: register 'gl620a' at usb-dummy_hcd.0-1, ...
------------[ cut here ]------------
usb 5-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 2 PID: 1841 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503
Modules linked in:
CPU: 2 UID: 0 PID: 1841 Comm: kworker/2:2 Not tainted 6.12.0-syzkaller-07834-g06afb0f36106 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: mld mld_ifc_work
RIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503
...
Call Trace:
 <TASK>
 usbnet_start_xmit+0x6be/0x2780 drivers/net/usb/usbnet.c:1467
 __netdev_start_xmit include/linux/netdevice.h:5002 [inline]
 netdev_start_xmit include/linux/netdevice.h:5011 [inline]
 xmit_one net/core/dev.c:3590 [inline]
 dev_hard_start_xmit+0x9a/0x7b0 net/core/dev.c:3606
 sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343
 __dev_xmit_skb net/core/dev.c:3827 [inline]
 __dev_queue_xmit+0x13d4/0x43e0 net/core/dev.c:4400
 dev_queue_xmit include/linux/netdevice.h:3168 [inline]
 neigh_resolve_output net/core/neighbour.c:1514 [inline]
 neigh_resolve_output+0x5bc/0x950 net/core/neighbour.c:1494
 neigh_output include/net/neighbour.h:539 [inline]
 ip6_finish_output2+0xb1b/0x2070 net/ipv6/ip6_output.c:141
 __ip6_finish_output net/ipv6/ip6_output.c:215 [inline]
 ip6_finish_output+0x3f9/0x1360 net/ipv6/ip6_output.c:226
 NF_HOOK_COND include/linux/netfilter.h:303 [inline]
 ip6_output+0x1f8/0x540 net/ipv6/ip6_output.c:247
 dst_output include/net/dst.h:450 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 mld_sendpack+0x9f0/0x11d0 net/ipv6/mcast.c:1819
 mld_send_cr net/ipv6/mcast.c:2120 [inline]
 mld_ifc_work+0x740/0xca0 net/ipv6/mcast.c:2651
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Reported-by: syzbot+d693c07c6f647e0388d3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d693c07c6f647e0388d3
Fixes: 47ee3051c8 ("[PATCH] USB: usbnet (5/9) module for genesys gl620a cables")
Cc: stable@vger.kernel.org
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Link: https://patch.msgid.link/20250224172919.1220522-1-n.zhandarovich@fintech.ru
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		2025-02-27 11:35:10 +01:00
..
Kconfig net: usb: r8152: Use linkmode helpers for EEE 2024-02-28 12:18:04 +00:00
Makefile
…
aqc111.c usb: aqc111: stop lying about skb->truesize 2024-05-07 17:37:24 -07:00
aqc111.h
…
asix.h
…
asix_common.c
…
asix_devices.c net: annotate writes on dev->mtu from ndo_change_mtu() 2024-05-07 16:19:14 -07:00
ax88172a.c asix: Add check for usbnet_get_endpoints 2024-01-04 10:50:57 +00:00
ax88179_178a.c net: usb: ax88179_178a: improve link status logs 2024-06-24 10:15:09 +01:00
catc.c
…
cdc-phonet.c
…
cdc_eem.c
…
cdc_ether.c net: usb: cdc_ether: don't spew notifications 2024-08-09 22:01:01 -07:00
cdc_mbim.c ipv6: annotate data-races around cnf.forwarding 2024-03-01 08:42:31 +00:00
cdc_ncm.c CDC-NCM: add support for Apple's private interface 2024-06-12 18:57:03 -07:00
cdc_subset.c
…
ch9200.c
…
cx82310_eth.c
…
dm9601.c net: usb: dm9601: fix wrong return value in dm9601_mdio_read 2024-02-27 18:17:23 -08:00
gl620a.c usbnet: gl620a: fix endpoint checking in genelink_bind() 2025-02-27 11:35:10 +01:00
hso.c net: hso: constify the struct device_type usage 2024-02-21 09:45:23 +00:00
huawei_cdc_ncm.c
…
int51x1.c
…
ipheth.c usbnet: ipheth: document scope of NCM implementation 2025-01-28 12:16:32 +01:00
kalmia.c
…
kaweth.c
…
lan78xx.c net: usb: lan78xx: Improve error handling in WoL operations 2024-12-17 19:51:55 -08:00
lan78xx.h
…
lg-vl600.c
…
mcs7830.c
…
net1080.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
pegasus.c
…
pegasus.h
…
plusb.c
…
qmi_wwan.c net: usb: qmi_wwan: add Quectel RG255C 2024-12-18 17:24:03 -08:00
r8152.c usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver 2024-10-28 16:22:35 -07:00
r8153_ecm.c
…
rndis_host.c
…
rtl8150.c net: usb: rtl8150: enable basic endpoint checking 2025-01-28 11:55:22 +01:00
sierra_net.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
smsc75xx.c net: usb: remove unused structs 'usb_context' 2024-05-28 15:24:34 +02:00
smsc75xx.h
…
smsc95xx.c net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM 2024-05-27 12:48:23 +02:00
smsc95xx.h
…
sr9700.c net: usb: sr9700: only store little-endian values in __le16 variable 2024-10-17 18:09:13 -05:00
sr9700.h
…
sr9800.c sr9800: Add check for usbnet_get_endpoints 2024-03-06 20:33:01 -08:00
sr9800.h
…
usbnet.c net: usb: usbnet: fix name regression 2024-10-22 13:24:26 +02:00
zaurus.c
…