android/android_kernel_samsung_sm8650
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
323ee5fc98
android_kernel_samsung_sm8650/drivers/media/radio
History
Alan Stern 53764a17f5 media: radio-shark: Add endpoint checks 
commit 76e31045ba030e94e72105c01b2e98f543d175ac upstream.

The syzbot fuzzer was able to provoke a WARNING from the radio-shark2
driver:

------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 0 PID: 3271 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504
Modules linked in:
CPU: 0 PID: 3271 Comm: kworker/0:3 Not tainted 6.1.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504
Code: 7c 24 18 e8 00 36 ea fb 48 8b 7c 24 18 e8 36 1c 02 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 b6 90 8a e8 9a 29 b8 03 <0f> 0b e9 58 f8 ff ff e8 d2 35 ea fb 48 81 c5 c0 05 00 00 e9 84 f7
RSP: 0018:ffffc90003876dd0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffff8880750b0040 RSI: ffffffff816152b8 RDI: fffff5200070edac
RBP: ffff8880172d81e0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8880285c5040 R14: 0000000000000002 R15: ffff888017158200
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe03235b90 CR3: 000000000bc8e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58
 usb_bulk_msg+0x226/0x550 drivers/usb/core/message.c:387
 shark_write_reg+0x1ff/0x2e0 drivers/media/radio/radio-shark2.c:88
...

The problem was caused by the fact that the driver does not check
whether the endpoints it uses are actually present and have the
appropriate types.  This can be fixed by adding a simple check of
these endpoints (and similarly for the radio-shark driver).

Link: https://syzkaller.appspot.com/bug?extid=4b3f8190f6e13b3efd74
Reported-and-tested-by: syzbot+4b3f8190f6e13b3efd74@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/e2858ab4-4adf-46e5-bbf6-c56742034547@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-30 14:03:20 +01:00
..
si470x media: si470x: Fix use-after-free in si470x_int_in_callback() 2022-12-31 13:33:04 +01:00
si4713 media fixes for v6.1-rc2 2022-10-22 15:30:15 -07:00
wl128x media: Kconfig: cleanup VIDEO_DEV dependencies 2022-03-18 05:58:35 +01:00
dsbr100.c Linux 5.2-rc4 2019-06-11 12:09:28 -04:00
Kconfig media: make RADIO_ADAPTERS tristate 2022-05-13 11:02:19 +02:00
lm7000.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Makefile media: Makefiles: sort entries where it fits 2022-03-14 09:42:59 +01:00
radio-aimslab.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
radio-aztech.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
radio-cadet.c media: media/radio: set device_caps in struct video_device 2019-06-05 08:19:12 -04:00
radio-gemtek.c media: don't do a 31 bit shift on a signed int 2019-08-26 14:11:10 -03:00
radio-isa.c isa: Make the remove callback for isa drivers return void 2021-01-26 07:42:27 +01:00
radio-isa.h isa: Make the remove callback for isa drivers return void 2021-01-26 07:42:27 +01:00
radio-keene.c Linux 5.2-rc4 2019-06-11 12:09:28 -04:00
radio-ma901.c Linux 5.2-rc4 2019-06-11 12:09:28 -04:00
radio-maxiradio.c media: v4l: ioctl: Set bus_info in v4l_querycap() 2022-04-24 08:07:08 +01:00
radio-miropcm20.c media: media/radio: set device_caps in struct video_device 2019-06-05 08:19:12 -04:00
radio-mr800.c Linux 5.2-rc4 2019-06-11 12:09:28 -04:00
radio-raremono.c media: radio-raremono: change devm_k*alloc to k*alloc 2019-06-27 07:35:24 -04:00
radio-rtrack2.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
radio-sf16fmi.c media: media/radio: make array probe_ports static const 2022-01-23 21:18:43 +01:00
radio-sf16fmr2.c isa: Make the remove callback for isa drivers return void 2021-01-26 07:42:27 +01:00
radio-shark2.c media: radio-shark: Add endpoint checks 2023-05-30 14:03:20 +01:00
radio-shark.c media: radio-shark: Add endpoint checks 2023-05-30 14:03:20 +01:00
radio-si476x.c media: radio-si476x: Remove the unneeded result variable 2022-09-24 08:52:21 +02:00
radio-tea5764.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
radio-tea5777.c Linux 5.2-rc4 2019-06-11 12:09:28 -04:00
radio-tea5777.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
radio-terratec.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
radio-timb.c Linux 5.2-rc4 2019-06-11 12:09:28 -04:00
radio-trust.c media: remove include stdarg.h from some drivers 2019-08-26 14:01:44 -03:00
radio-typhoon.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
radio-wl1273.c media: radio-wl1273: Avoid card name truncation 2021-09-30 10:07:59 +02:00
radio-zoltrix.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
saa7706h.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
tea575x.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
tef6862.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00