Patch "wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes" has been added to the 4.19-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     wifi-ath9k-don-t-allow-to-overwrite-endpoint0-attrib.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit cbdd7ba95d47d114975b51072b4265f8344abe37
Author: Fedor Pchelkin <pchelkin@xxxxxxxxx>
Date:   Wed May 17 18:03:17 2023 +0300

    wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
    
    [ Upstream commit 061b0cb9327b80d7a0f63a33e7c3e2a91a71f142 ]
    
    A bad USB device is able to construct a service connection response
    message with target endpoint being ENDPOINT0 which is reserved for
    HTC_CTRL_RSVD_SVC and should not be modified to be used for any other
    services.
    
    Reject such service connection responses.
    
    Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
    
    Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
    Reported-by: syzbot+b68fbebe56d8362907e8@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Fedor Pchelkin <pchelkin@xxxxxxxxx>
    Acked-by: Toke Høiland-Jørgensen <toke@xxxxxxx>
    Signed-off-by: Kalle Valo <quic_kvalo@xxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230516150427.79469-1-pchelkin@xxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 6331c98088e03..d5e5f9cf4ca86 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -114,7 +114,13 @@ static void htc_process_conn_rsp(struct htc_target *target,
 
 	if (svc_rspmsg->status == HTC_SERVICE_SUCCESS) {
 		epid = svc_rspmsg->endpoint_id;
-		if (epid < 0 || epid >= ENDPOINT_MAX)
+
+		/* Check that the received epid for the endpoint to attach
+		 * a new service is valid. ENDPOINT0 can't be used here as it
+		 * is already reserved for HTC_CTRL_RSVD_SVC service and thus
+		 * should not be modified.
+		 */
+		if (epid <= ENDPOINT0 || epid >= ENDPOINT_MAX)
 			return;
 
 		service_id = be16_to_cpu(svc_rspmsg->service_id);



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux