On Mon, Jul 12, 2021 at 02:54:36PM -0400, Alan Stern wrote:
> When the user submits a control URB via usbfs, the user supplies the
> bRequestType value and the kernel uses it to compute the pipe value.
> However, do_proc_control() performs this computation incorrectly in
> the case where the bRequestType direction bit is set to USB_DIR_IN and
> the URB's transfer length is 0: The pipe's direction is also set to IN
> but it should be OUT, which is the direction the actual transfer will
> use regardless of bRequestType.
>
> Commit 5cc59c418fde ("USB: core: WARN if pipe direction != setup
> packet direction") added a check to compare the direction bit in the
> pipe value to a control URB's actual direction and to WARN if they are
> different. This can be triggered by the incorrect computation
> mentioned above, as found by syzbot.
>
> This patch fixes the computation, thus avoiding the WARNing.
>
> Signed-off-by: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
> Reported-and-tested-by: syzbot+72af3105289dcb4c055b@xxxxxxxxxxxxxxxxxxxxxxxxx
>
> ---
>
> Greg, I'm not sure which -stable kernels, if any, need this. It should
> go into any kernel which contains 5cc59c418fde.
That's just 5.14-rc1, I asked for AUTOSEL to not take it so we should be
fine.
Thanks for the fix, I'll queue it up now.
greg k-h
