• Pavel Skripkin's avatar
    video: fbdev: udlfb: properly check endpoint type · aaf7dbe0
    Pavel Skripkin authored
    syzbot reported warning in usb_submit_urb, which is caused by wrong
    endpoint type.
    
    This driver uses out bulk endpoint for communication, so
    let's check if this endpoint is present and bail out early if not.
    
    Fail log:
    
    usb 1-1: BOGUS urb xfer, pipe 3 != type 1
    WARNING: CPU: 0 PID: 4822 at drivers/usb/core/urb.c:493 usb_submit_urb+0xd27/0x1540 drivers/usb/core/urb.c:493
    Modules linked in:
    CPU: 0 PID: 4822 Comm: kworker/0:3 Tainted: G        W         5.13.0-syzkaller #0
    ...
    Workqueue: usb_hub_wq hub_event
    RIP: 0010:usb_submit_urb+0xd27/0x1540 drivers/usb/core/urb.c:493
    ...
    Call Trace:
     dlfb_submit_urb+0x89/0x160 drivers/video/fbdev/udlfb.c:1969
     dlfb_set_video_mode+0x21f0/0x2950 drivers/video/fbdev/udlfb.c:315
     dlfb_ops_set_par+0x2a3/0x840 drivers/video/fbdev/udlfb.c:1110
     dlfb_usb_probe.cold+0x113e/0x1f4a drivers/video/fbdev/udlfb.c:1732
     usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396
    
    Fixes: 88e58b1a ("Staging: add udlfb driver")
    Reported-and-tested-by: syzbot+53ce4a4246d0fe0fee34@syzkaller.appspotmail.com
    Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
    Signed-off-by: default avatarHelge Deller <deller@gmx.de>
    aaf7dbe0
udlfb.c 51.6 KB