Commit 0f894baf authored by Johan Hovold's avatar Johan Hovold Committed by Khalid Elmously

brcmfmac: fix interface sanity check

BugLink: https://bugs.launchpad.net/bugs/1864774

commit 3428fbcd upstream.

Make sure to use the current alternate setting when verifying the
interface descriptors to avoid binding to an invalid interface.

Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: 71bb244b ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
Cc: stable <stable@vger.kernel.org>     # 3.4
Cc: Arend van Spriel <arend@broadcom.com>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarKhalid Elmously <khalid.elmously@canonical.com>
Signed-off-by: default avatarKleber Sacilotto de Souza <kleber.souza@canonical.com>
parent 30bfda6e
...@@ -1352,7 +1352,7 @@ brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) ...@@ -1352,7 +1352,7 @@ brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
goto fail; goto fail;
} }
desc = &intf->altsetting[0].desc; desc = &intf->cur_altsetting->desc;
if ((desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) || if ((desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) ||
(desc->bInterfaceSubClass != 2) || (desc->bInterfaceSubClass != 2) ||
(desc->bInterfaceProtocol != 0xff)) { (desc->bInterfaceProtocol != 0xff)) {
...@@ -1365,7 +1365,7 @@ brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) ...@@ -1365,7 +1365,7 @@ brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
num_of_eps = desc->bNumEndpoints; num_of_eps = desc->bNumEndpoints;
for (ep = 0; ep < num_of_eps; ep++) { for (ep = 0; ep < num_of_eps; ep++) {
endpoint = &intf->altsetting[0].endpoint[ep].desc; endpoint = &intf->cur_altsetting->endpoint[ep].desc;
endpoint_num = usb_endpoint_num(endpoint); endpoint_num = usb_endpoint_num(endpoint);
if (!usb_endpoint_xfer_bulk(endpoint)) if (!usb_endpoint_xfer_bulk(endpoint))
continue; continue;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment