Received: by 2002:a05:6a10:2726:0:0:0:0 with SMTP id ib38csp649118pxb; Tue, 5 Apr 2022 17:16:19 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxb0K1cycNsMztaWUG0Kp+ojHOfkUy0irSkSyp/yJX4nCEpNDbCQcpKZN1VbJe6l5Yrzj4M X-Received: by 2002:a17:90b:4a41:b0:1c7:a0d7:718c with SMTP id lb1-20020a17090b4a4100b001c7a0d7718cmr6883928pjb.57.1649204179282; Tue, 05 Apr 2022 17:16:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1649204179; cv=none; d=google.com; s=arc-20160816; b=ik9unXNyPoF3SjtoJCnwfO0CV/l3BMl6PLrKxjHmc4p8jLqrGs+DVCbaYiovok9e10 UkRJGS6tKn2HLQ5qFr/IYUU5a49oFb14aup1bZyU1XsNV4Wq8BUQySOLxJL7QMAQhR3R TZe8PvWkf5wE6sdFg8+G+Dpb0YeG4ittmngFny3OrhWMl2rz+M2PQ0ArcC2i09hWJMpw zjp5+apLjHgg3uHiuGhYEDzlIhrMQMJbE2cmUHfPAjAuihpnOMCvWhXkbxq0SsOxVNsH fjbEQERgQc8GbPI6o57YyHN36mlJ55Ns0oopCtHUzSNeVwQbPxIbALrEMwwMzPAB5g1Y UCqA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=KCHmwUnCp5CZz2XwkyhN6TjXdqI6yJejkzwVrqdw0IQ=; b=fLb9qcbE/yexJWqN1+30mojtp5d7uMAapnzrpwPGHUsUAID+zRFEJyS2Cz6gZeqvn1 bdX3X48AG3PGIgUUfQ5nMvKUipDA4MMb8QbcKG8dzdKbkma6dlgYbHUGLGbhdGBUkaJt PUAtul7OGw+VrL4/64+dnIxJcYnryHKsbK4UeR8ZBOc2UtlJKDWotIVWwqSRA5RMMMKs TufWf3/uGYceEu/swMbWt16GcNUyqvrwti5qu7NU5mbvbMF3RqVr7PKF/c6CoCh+OiYf ZxofgvOJrQV+mUVAGtnaAx7OfO7X4WOn8ebN0KowY7LRJM+H+AUEAcY//fNDBWNkcTp+ n83Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="czSqcoa/"; spf=softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net. [23.128.96.19]) by mx.google.com with ESMTPS id e12-20020a17090301cc00b00156b62c1a7esi5804922plh.573.2022.04.05.17.16.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 05 Apr 2022 17:16:19 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="czSqcoa/"; spf=softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 4883775C3F; Tue, 5 Apr 2022 17:00:28 -0700 (PDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238589AbiDEN4h (ORCPT + 99 others); Tue, 5 Apr 2022 09:56:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44122 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347739AbiDEJ2O (ORCPT ); Tue, 5 Apr 2022 05:28:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E1650DFD7A; Tue, 5 Apr 2022 02:15:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 23E2BB818F3; Tue, 5 Apr 2022 09:15:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 63896C385A0; Tue, 5 Apr 2022 09:15:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649150124; bh=Xt7afQvQqXUQxnHQRQb7yFraVXo0NKAKwUkzf0P7wPQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=czSqcoa/FDH3Dsr+jCw/u0TZgLYGgdzz4KjHVr+Fo3FJY2CNP+KlpFO8zBSfMlBA+ anbF3O/iikW7tnHKcQ+FCRGsPGMVBzFQF2aW2i7Pk9K3hSZ4hjRz0XIwKXlQOv4T5p y98ovBnSn9bzbpsK5Hq5ASy2/QC31nkZqGJqqko4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , Vincent Mailhol , Marc Kleine-Budde , syzbot+3bc1dce0cc0052d60fde@syzkaller.appspotmail.com Subject: [PATCH 5.16 0924/1017] can: mcba_usb: properly check endpoint type Date: Tue, 5 Apr 2022 09:30:37 +0200 Message-Id: <20220405070421.645176454@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070354.155796697@linuxfoundation.org> References: <20220405070354.155796697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pavel Skripkin commit 136bed0bfd3bc9c95c88aafff2d22ecb3a919f23 upstream. Syzbot reported warning in usb_submit_urb() which is caused by wrong endpoint type. We should check that in endpoint is actually present to prevent this warning. Found pipes are now saved to struct mcba_priv and code uses them directly instead of making pipes in place. Fail log: | usb 5-1: BOGUS urb xfer, pipe 3 != type 1 | WARNING: CPU: 1 PID: 49 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 | Modules linked in: | CPU: 1 PID: 49 Comm: kworker/1:2 Not tainted 5.17.0-rc6-syzkaller-00184-g38f80f42147f #0 | Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 | Workqueue: usb_hub_wq hub_event | RIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 | ... | Call Trace: | | mcba_usb_start drivers/net/can/usb/mcba_usb.c:662 [inline] | mcba_usb_probe+0x8a3/0xc50 drivers/net/can/usb/mcba_usb.c:858 | usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396 | call_driver_probe drivers/base/dd.c:517 [inline] Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer") Link: https://lore.kernel.org/all/20220313100903.10868-1-paskripkin@gmail.com Reported-and-tested-by: syzbot+3bc1dce0cc0052d60fde@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin Reviewed-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman --- drivers/net/can/usb/mcba_usb.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) --- a/drivers/net/can/usb/mcba_usb.c +++ b/drivers/net/can/usb/mcba_usb.c @@ -33,10 +33,6 @@ #define MCBA_USB_RX_BUFF_SIZE 64 #define MCBA_USB_TX_BUFF_SIZE (sizeof(struct mcba_usb_msg)) -/* MCBA endpoint numbers */ -#define MCBA_USB_EP_IN 1 -#define MCBA_USB_EP_OUT 1 - /* Microchip command id */ #define MBCA_CMD_RECEIVE_MESSAGE 0xE3 #define MBCA_CMD_I_AM_ALIVE_FROM_CAN 0xF5 @@ -84,6 +80,8 @@ struct mcba_priv { atomic_t free_ctx_cnt; void *rxbuf[MCBA_MAX_RX_URBS]; dma_addr_t rxbuf_dma[MCBA_MAX_RX_URBS]; + int rx_pipe; + int tx_pipe; }; /* CAN frame */ @@ -272,10 +270,8 @@ static netdev_tx_t mcba_usb_xmit(struct memcpy(buf, usb_msg, MCBA_USB_TX_BUFF_SIZE); - usb_fill_bulk_urb(urb, priv->udev, - usb_sndbulkpipe(priv->udev, MCBA_USB_EP_OUT), buf, - MCBA_USB_TX_BUFF_SIZE, mcba_usb_write_bulk_callback, - ctx); + usb_fill_bulk_urb(urb, priv->udev, priv->tx_pipe, buf, MCBA_USB_TX_BUFF_SIZE, + mcba_usb_write_bulk_callback, ctx); urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; usb_anchor_urb(urb, &priv->tx_submitted); @@ -610,7 +606,7 @@ static void mcba_usb_read_bulk_callback( resubmit_urb: usb_fill_bulk_urb(urb, priv->udev, - usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_OUT), + priv->rx_pipe, urb->transfer_buffer, MCBA_USB_RX_BUFF_SIZE, mcba_usb_read_bulk_callback, priv); @@ -655,7 +651,7 @@ static int mcba_usb_start(struct mcba_pr urb->transfer_dma = buf_dma; usb_fill_bulk_urb(urb, priv->udev, - usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN), + priv->rx_pipe, buf, MCBA_USB_RX_BUFF_SIZE, mcba_usb_read_bulk_callback, priv); urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; @@ -809,6 +805,13 @@ static int mcba_usb_probe(struct usb_int struct mcba_priv *priv; int err; struct usb_device *usbdev = interface_to_usbdev(intf); + struct usb_endpoint_descriptor *in, *out; + + err = usb_find_common_endpoints(intf->cur_altsetting, &in, &out, NULL, NULL); + if (err) { + dev_err(&intf->dev, "Can't find endpoints\n"); + return err; + } netdev = alloc_candev(sizeof(struct mcba_priv), MCBA_MAX_TX_URBS); if (!netdev) { @@ -854,6 +857,9 @@ static int mcba_usb_probe(struct usb_int goto cleanup_free_candev; } + priv->rx_pipe = usb_rcvbulkpipe(priv->udev, in->bEndpointAddress); + priv->tx_pipe = usb_sndbulkpipe(priv->udev, out->bEndpointAddress); + devm_can_led_init(netdev); /* Start USB dev only if we have successfully registered CAN device */