kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/net/usb
History
Bjørn Mork 4a14bd934b net: qmi_wwan: fix divide by 0 on bad descriptors 
commit 7fd0783372 upstream.

A CDC Ethernet functional descriptor with wMaxSegmentSize = 0 will
cause a divide error in usbnet_probe:

divide error: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.0-rc8-44453-g1fdc1a82c34f #56
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: usb_hub_wq hub_event
task: ffff88006bef5c00 task.stack: ffff88006bf60000
RIP: 0010:usbnet_update_max_qlen+0x24d/0x390 drivers/net/usb/usbnet.c:355
RSP: 0018:ffff88006bf67508 EFLAGS: 00010246
RAX: 00000000000163c8 RBX: ffff8800621fce40 RCX: ffff8800621fcf34
RDX: 0000000000000000 RSI: ffffffff837ecb7a RDI: ffff8800621fcf34
RBP: ffff88006bf67520 R08: ffff88006bef5c00 R09: ffffed000c43f881
R10: ffffed000c43f880 R11: ffff8800621fc406 R12: 0000000000000003
R13: ffffffff85c71de0 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88006ca00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe9c0d6dac CR3: 00000000614f4000 CR4: 00000000000006f0
Call Trace:
 usbnet_probe+0x18b5/0x2790 drivers/net/usb/usbnet.c:1783
 qmi_wwan_probe+0x133/0x220 drivers/net/usb/qmi_wwan.c:1338
 usb_probe_interface+0x324/0x940 drivers/usb/core/driver.c:361
 really_probe drivers/base/dd.c:413
 driver_probe_device+0x522/0x740 drivers/base/dd.c:557

Fix by simply ignoring the bogus descriptor, as it is optional
for QMI devices anyway.

Fixes: 423ce8caab ("net: usb: qmi_wwan: New driver for Huawei QMI based WWAN devices")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2017-11-26 13:50:39 +00:00
..
asix.h drivers/net: delete non-required instances of include <linux/init.h> 2014-01-16 11:53:26 -08:00
asix_common.c usbnet: Fix tx_bytes statistic running backward in cdc_ncm 2015-04-27 09:48:14 +01:00
asix_devices.c asix: Do full reset during ax88772_bind 2015-10-19 11:20:24 +01:00
ax88172a.c usb: Fix FSF address in file headers 2013-12-06 12:37:55 -05:00
ax88179_178a.c ax88179_178a: fix bonding failure 2014-11-05 16:36:22 +00:00
catc.c catc: Use heap buffer for memory size test 2017-03-16 02:27:10 +00:00
cdc-phonet.c net: cdc-phonet: Staticize usbpn_probe 2013-09-20 14:41:02 -04:00
cdc_eem.c drivers/net: delete non-required instances of include <linux/init.h> 2014-01-16 11:53:26 -08:00
cdc_ether.c net: cdc_ether: fix divide by 0 on bad descriptors 2017-11-26 13:50:39 +00:00
cdc_mbim.c net: cdc_ncm/cdc_mbim: adding NCM protocol statistics 2014-05-16 22:39:01 -04:00
cdc_ncm.c cdc_ncm: workaround for EM7455 "silent" data interface 2017-03-16 02:27:18 +00:00
cdc_subset.c Revert "cdc_subset: deal with a device that needs reset for timeout" 2014-07-30 08:56:23 -07:00
cx82310_eth.c cx82310_eth: use skb_cow_head() to deal with cloned skbs 2017-07-18 18:40:38 +01:00
dm9601.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-01-18 00:55:41 -08:00
gl620a.c usbnet: remove generic hard_header_len check 2014-02-17 14:35:46 -05:00
hso.c hso: fix deadlock when receiving bursts of data 2014-07-14 19:27:34 -07:00
huawei_cdc_ncm.c net: huawei_cdc_ncm: add "subclass 3" devices 2014-07-17 16:49:50 -07:00
int51x1.c usb: Fix FSF address in file headers 2013-12-06 12:37:55 -05:00
ipheth.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-06-03 23:32:12 -07:00
kalmia.c drivers/net: delete non-required instances of include <linux/init.h> 2014-01-16 11:53:26 -08:00
kaweth.c net: get rid of SET_ETHTOOL_OPS 2014-05-13 17:43:20 -04:00
Kconfig USB2NET: Fix Default to 'y' for SR9800 Device Driver, setting to 'n' 2014-02-13 18:42:01 -05:00
lg-vl600.c lg-vl600: Convert uses of __constant_<foo> to <foo> 2014-03-12 15:28:06 -04:00
Makefile r8152: disable the ECM mode 2014-03-05 20:40:24 -05:00
mcs7830.c usbnet: remove generic hard_header_len check 2014-02-17 14:35:46 -05:00
net1080.c usbnet: remove generic hard_header_len check 2014-02-17 14:35:46 -05:00
pegasus.c pegasus: Use heap buffers for all register access 2017-03-16 02:27:10 +00:00
pegasus.h drivers: net: usb: pegasus: fix control urb submission 2013-04-29 13:57:50 -04:00
plusb.c usb: plusb: Add support for National Instruments host-to-host cable 2015-03-12 16:27:46 +00:00
qmi_wwan.c net: qmi_wwan: fix divide by 0 on bad descriptors 2017-11-26 13:50:39 +00:00
r8152.c r8152: fix the sw rx checksum is unavailable 2017-03-16 02:27:23 +00:00
rndis_host.c usbnet: remove generic hard_header_len check 2014-02-17 14:35:46 -05:00
rtl8150.c rtl8150: Use heap buffers for all register access 2017-03-16 02:27:10 +00:00
sierra_net.c usb: Fix FSF address in file headers 2013-12-06 12:37:55 -05:00
smsc75xx.c smsc75xx: use skb_cow_head() to deal with cloned skbs 2017-07-18 18:40:37 +01:00
smsc75xx.h usb: Fix FSF address in file headers 2013-12-06 12:37:55 -05:00
smsc95xx.c smsc95xx: Configure pause time to 0xffff when tx flow control enabled 2017-11-26 13:50:37 +00:00
smsc95xx.h usb: Fix FSF address in file headers 2013-12-06 12:37:55 -05:00
sr9700.c sr9700: use skb_cow_head() to deal with cloned skbs 2017-07-18 18:40:38 +01:00
sr9700.h USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support 2013-09-03 22:26:03 -04:00
sr9800.c usbnet: Fix tx_bytes statistic running backward in cdc_ncm 2015-04-27 09:48:14 +01:00
sr9800.h USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support 2014-02-10 16:53:06 -08:00
usbnet.c usbnet: cleanup after bind() in probe() 2016-05-01 00:06:10 +02:00
zaurus.c drivers/net: delete non-required instances of include <linux/init.h> 2014-01-16 11:53:26 -08:00