Johan Hovold 89f8765a11 mwifiex: fix division by zero in fw download path ... Add the missing endpoint sanity checks to probe() to avoid division by zero in mwifiex_write_data_sync() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Only add checks for the firmware-download boot stage, which require both command endpoints, for now. The driver looks like it will handle a missing endpoint during normal operation without oopsing, albeit not very gracefully as it will try to submit URBs to the default pipe and fail. Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4f ("USB: Fix: Don't skip endpoint descriptors with maxpacket=0")). Fixes: 4daffe3543 ("mwifiex: add support for Marvell USB8797 chipset") Cc: stable@vger.kernel.org # 3.5 Cc: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211027080819.6675-4-johan@kernel.org		2021-10-28 16:27:25 +03:00
..
libertas	libertas: replace snprintf in show functions with sysfs_emit	2021-10-27 10:38:29 +03:00
libertas_tf	libertas_tf: Fix possible memory leak in probe and disconnect	2021-10-27 10:32:21 +03:00
mwifiex	mwifiex: fix division by zero in fw download path	2021-10-28 16:27:25 +03:00
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
mwl8k.c	mwl8k: Fix use-after-free in mwl8k_fw_state_machine()	2021-10-20 11:41:21 +03:00