tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net: usb: catc: enable basic endpoint checking

catc_probe() fills three URBs with hardcoded endpoint pipes without
verifying the endpoint descriptors:

- usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX
- usb_rcvintpipe(usbdev, 2) for interrupt status

A malformed USB device can present these endpoints with transfer types
that differ from what the driver assumes.

Add a catc_usb_ep enum for endpoint numbers, replacing magic constants
throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints()
calls after usb_set_interface() to verify endpoint types before use,
rejecting devices with mismatched descriptors at probe time.

Similar to
- commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking")
which fixed the issue in rtl8150.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Suggested-by: Simon Horman <horms@kernel.org>
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Link: https://patch.msgid.link/20260212214154.3609844-1-n7l8m4@u.northwestern.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

authored by

Ziyi Guo and committed by
Paolo Abeni 9e7021d2 94560267

+31 -6
+31 -6
drivers/net/usb/catc.c
··· 59 59 #define RX_PKT_SZ 1600 /* Max size of receive packet for F5U011 */ 60 60 61 61 /* 62 + * USB endpoints. 63 + */ 64 + 65 + enum catc_usb_ep { 66 + CATC_USB_EP_CONTROL = 0, 67 + CATC_USB_EP_BULK = 1, 68 + CATC_USB_EP_INT_IN = 2, 69 + }; 70 + 71 + /* 62 72 * Control requests. 63 73 */ 64 74 ··· 775 765 u8 broadcast[ETH_ALEN]; 776 766 u8 *macbuf; 777 767 int pktsz, ret = -ENOMEM; 768 + static const u8 bulk_ep_addr[] = { 769 + CATC_USB_EP_BULK | USB_DIR_OUT, 770 + CATC_USB_EP_BULK | USB_DIR_IN, 771 + 0}; 772 + static const u8 int_ep_addr[] = { 773 + CATC_USB_EP_INT_IN | USB_DIR_IN, 774 + 0}; 778 775 779 776 macbuf = kmalloc(ETH_ALEN, GFP_KERNEL); 780 777 if (!macbuf) ··· 791 774 intf->altsetting->desc.bInterfaceNumber, 1)) { 792 775 dev_err(dev, "Can't set altsetting 1.\n"); 793 776 ret = -EIO; 777 + goto fail_mem; 778 + } 779 + 780 + /* Verify that all required endpoints are present */ 781 + if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) || 782 + !usb_check_int_endpoints(intf, int_ep_addr)) { 783 + dev_err(dev, "Missing or invalid endpoints\n"); 784 + ret = -ENODEV; 794 785 goto fail_mem; 795 786 } 796 787 ··· 846 821 usb_fill_control_urb(catc->ctrl_urb, usbdev, usb_sndctrlpipe(usbdev, 0), 847 822 NULL, NULL, 0, catc_ctrl_done, catc); 848 823 849 - usb_fill_bulk_urb(catc->tx_urb, usbdev, usb_sndbulkpipe(usbdev, 1), 850 - NULL, 0, catc_tx_done, catc); 824 + usb_fill_bulk_urb(catc->tx_urb, usbdev, usb_sndbulkpipe(usbdev, CATC_USB_EP_BULK), 825 + NULL, 0, catc_tx_done, catc); 851 826 852 - usb_fill_bulk_urb(catc->rx_urb, usbdev, usb_rcvbulkpipe(usbdev, 1), 853 - catc->rx_buf, pktsz, catc_rx_done, catc); 827 + usb_fill_bulk_urb(catc->rx_urb, usbdev, usb_rcvbulkpipe(usbdev, CATC_USB_EP_BULK), 828 + catc->rx_buf, pktsz, catc_rx_done, catc); 854 829 855 - usb_fill_int_urb(catc->irq_urb, usbdev, usb_rcvintpipe(usbdev, 2), 856 - catc->irq_buf, 2, catc_irq_done, catc, 1); 830 + usb_fill_int_urb(catc->irq_urb, usbdev, usb_rcvintpipe(usbdev, CATC_USB_EP_INT_IN), 831 + catc->irq_buf, 2, catc_irq_done, catc, 1); 857 832 858 833 if (!catc->is_f5u011) { 859 834 u32 *buf;