]> git.ipfire.org Git - people/arne_f/kernel.git/commit
staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb()
authorRustam Kovhaev <rkovhaev@gmail.com>
Tue, 4 Aug 2020 14:56:14 +0000 (07:56 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 23 Sep 2020 08:46:30 +0000 (10:46 +0200)
commit5a023e34ee966b4e082dff5ed2b390584fb9bfca
treef463503ff9e3458f789388249cd2e06506088ded
parenteacd48c729e471c5a156dfd36d859f61481f5dbb
staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb()

commit fea22e159d51c766ba70473f473a0ec914cc7e92 upstream.

let's use usb_find_common_endpoints() to discover endpoints, it does all
necessary checks for type and xfer direction

remove memset() in hfa384x_create(), because we now assign endpoints in
prism2sta_probe_usb() and because create_wlan() uses kzalloc() to
allocate hfa384x struct before calling hfa384x_create()

Fixes: faaff9765664 ("staging: wlan-ng: properly check endpoint types")
Reported-and-tested-by: syzbot+22794221ab96b0bab53a@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=22794221ab96b0bab53a
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200804145614.104320-1-rkovhaev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/wlan-ng/hfa384x_usb.c
drivers/staging/wlan-ng/prism2usb.c