mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/drivers/net
History
Alan Stern 93fd565919 net: USB: Fix wrong-direction WARNING in plusb.c 
The syzbot fuzzer detected a bug in the plusb network driver: A
zero-length control-OUT transfer was treated as a read instead of a
write.  In modern kernels this error provokes a WARNING:

usb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
WARNING: CPU: 0 PID: 4645 at drivers/usb/core/urb.c:411
usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411
Modules linked in:
CPU: 1 PID: 4645 Comm: dhcpcd Not tainted
6.2.0-rc6-syzkaller-00050-g9f266ccaa2f5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
01/12/2023
RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411
...
Call Trace:
 <TASK>
 usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58
 usb_internal_control_msg drivers/usb/core/message.c:102 [inline]
 usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153
 __usbnet_read_cmd+0xb9/0x390 drivers/net/usb/usbnet.c:2010
 usbnet_read_cmd+0x96/0xf0 drivers/net/usb/usbnet.c:2068
 pl_vendor_req drivers/net/usb/plusb.c:60 [inline]
 pl_set_QuickLink_features drivers/net/usb/plusb.c:75 [inline]
 pl_reset+0x2f/0xf0 drivers/net/usb/plusb.c:85
 usbnet_open+0xcc/0x5d0 drivers/net/usb/usbnet.c:889
 __dev_open+0x297/0x4d0 net/core/dev.c:1417
 __dev_change_flags+0x587/0x750 net/core/dev.c:8530
 dev_change_flags+0x97/0x170 net/core/dev.c:8602
 devinet_ioctl+0x15a2/0x1d70 net/ipv4/devinet.c:1147
 inet_ioctl+0x33f/0x380 net/ipv4/af_inet.c:979
 sock_do_ioctl+0xcc/0x230 net/socket.c:1169
 sock_ioctl+0x1f8/0x680 net/socket.c:1286
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl fs/ioctl.c:856 [inline]
 __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The fix is to call usbnet_write_cmd() instead of usbnet_read_cmd() and
remove the USB_DIR_IN flag.

Reported-and-tested-by: syzbot+2a0e7abd24f1eb90ce25@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 090ffa9d0e ("[PATCH] USB: usbnet (9/9) module for pl2301/2302 cables")
CC: stable@vger.kernel.org
Link: https://lore.kernel.org/r/00000000000052099f05f3b3e298@google.com/
Link: https://lore.kernel.org/r/Y91hOew3nW56Ki4O@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2023-02-06 13:46:41 +01:00
..
appletalk
…
arcnet
…
bonding drivers/net/bonding/bond_3ad: return when there's no aggregator 2023-01-03 09:17:12 +00:00
caif
…
can can: mcp251xfd: mcp251xfd_ring_set_ringparam(): assign missing tx_obj_num_coalesce_irq 2023-02-02 10:33:27 +01:00
dsa net: dsa: mt7530: fix tristate and help description 2023-01-27 22:33:49 -08:00
ethernet mtk_sgmii: enable PCS polling to allow SFP work 2023-02-02 11:55:53 -08:00
fddi net: defxx: Fix missing err handling in dfx_init() 2022-12-09 10:44:27 +00:00
fjes
…
hamradio Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-12-13 09:49:29 +01:00
hippi
…
hyperv hv_netvsc: Fix missed pagebuf entries in netvsc_dma_map/unmap() 2023-02-02 09:15:30 +01:00
ieee802154 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-12-08 18:19:59 -08:00
ipa net: ipa: disable ipa interrupt during suspend 2023-01-17 19:04:13 -08:00
ipvlan Driver Core changes for 6.2-rc1 2022-12-16 03:54:54 -08:00
mctp mctp: serial: Fix starting value for frame check sequence 2022-12-19 12:38:45 +00:00
mdio net: mdio-mux-meson-g12a: force internal PHY off on mux switch 2023-01-25 22:46:51 -08:00
netdevsim
…
pcs
…
phy net: phy: meson-gxl: Add generic dummy stubs for MMD register access 2023-01-31 21:13:11 -08:00
plip
…
ppp Networking changes for 6.2. 2022-12-13 15:47:48 -08:00
pse-pd
…
slip
…
team Revert "net: team: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf" 2023-01-18 20:32:44 -08:00
usb net: USB: Fix wrong-direction WARNING in plusb.c 2023-02-06 13:46:41 +01:00
vmxnet3 vmxnet3: correctly report csum_level for encapsulated packet 2022-12-21 17:55:30 -08:00
vxlan vxlan: Fix memory leaks in error path 2023-01-02 13:37:33 +00:00
wan net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs 2023-01-13 21:34:31 -08:00
wireguard wireguard: timers: cast enum limits members to int in prints 2022-12-13 19:30:45 -08:00
wireless wifi: mt76: dma: fix a regression in adding rx buffers 2023-01-16 17:27:17 +02:00
wwan net: wwan: t7xx: Fix Runtime PM initialization 2023-01-28 13:20:21 +00:00
xen-netback xen: branch for v6.2-rc4 2023-01-12 17:02:20 -06:00
Kconfig
…
LICENSE.SRC
…
Makefile
…
Space.c
…
amt.c
…
bareudp.c
…
dummy.c
…
eql.c
…
geneve.c
…
gtp.c
…
ifb.c
…
loopback.c
…
macsec.c net: macsec: fix net device access prior to holding a lock 2022-12-13 18:58:08 -08:00
macvlan.c
…
macvtap.c
…
mdio.c
…
mhi_net.c
…
mii.c
…
net_failover.c
…
netconsole.c
…
nlmon.c
…
ntb_netdev.c ntb_netdev: Use dev_kfree_skb_any() in interrupt context 2022-12-12 12:56:37 -08:00
rionet.c
…
sb1000.c
…
sungem_phy.c
…
tap.c driver/net/tun: Added features for USO. 2022-12-12 09:29:56 +00:00
thunderbolt.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-12-08 18:19:59 -08:00
tun.c driver/net/tun: Added features for USO. 2022-12-12 09:29:56 +00:00
veth.c veth: Fix race with AF_XDP exposing old or uninitialized descriptors 2022-12-22 15:06:10 +01:00
virtio_net.c virtio-net: Keep stop() to follow mirror sequence of open() 2023-02-02 10:10:53 -08:00
vrf.c net: vrf: determine the dst using the original ifindex for multicast 2022-12-21 17:47:37 -08:00
vsockmon.c
…
xen-netfront.c xen: branch for v6.2-rc4 2023-01-12 17:02:20 -06:00