qjyu
/
OrangePi_CM5
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
OrangePi_CM5/drivers/video/fbdev
History
Pavel Skripkin c4fb41bdf4 video: fbdev: udlfb: properly check endpoint type 
[ Upstream commit aaf7dbe07385e0b8deb7237eca2a79926bbc7091 ]

syzbot reported warning in usb_submit_urb, which is caused by wrong
endpoint type.

This driver uses out bulk endpoint for communication, so
let's check if this endpoint is present and bail out early if not.

Fail log:

usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 0 PID: 4822 at drivers/usb/core/urb.c:493 usb_submit_urb+0xd27/0x1540 drivers/usb/core/urb.c:493
Modules linked in:
CPU: 0 PID: 4822 Comm: kworker/0:3 Tainted: G        W         5.13.0-syzkaller #0
...
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0xd27/0x1540 drivers/usb/core/urb.c:493
...
Call Trace:
 dlfb_submit_urb+0x89/0x160 drivers/video/fbdev/udlfb.c:1969
 dlfb_set_video_mode+0x21f0/0x2950 drivers/video/fbdev/udlfb.c:315
 dlfb_ops_set_par+0x2a3/0x840 drivers/video/fbdev/udlfb.c:1110
 dlfb_usb_probe.cold+0x113e/0x1f4a drivers/video/fbdev/udlfb.c:1732
 usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396

Fixes: 88e58b1a42 ("Staging: add udlfb driver")
Reported-and-tested-by: syzbot+53ce4a4246d0fe0fee34@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2022-05-09 09:05:00 +02:00
..
aty
…
core video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() 2022-04-08 14:40:06 +02:00
geode
…
i810
…
intelfb
…
kyro video: fbdev: kyro: Error out if 'pixclock' equals zero 2021-09-18 13:40:22 +02:00
matrox video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen 2022-04-08 14:40:05 +02:00
mb862xx
…
mmp
…
nvidia video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow 2022-04-08 14:40:33 +02:00
omap
…
omap2 video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() 2022-04-08 14:40:35 +02:00
riva video: fbdev: riva: Error out if 'pixclock' equals zero 2021-09-18 13:40:22 +02:00
savage
…
sis
…
vermilion
…
via
…
68328fb.c
…
Kconfig
…
Makefile
…
acornfb.c
…
acornfb.h
…
amba-clcd.c amba: Make the remove callback return void 2022-04-08 14:40:02 +02:00
amifb.c
…
arcfb.c
…
arkfb.c
…
asiliantfb.c video: fbdev: asiliantfb: Error out if 'pixclock' equals zero 2021-09-18 13:40:22 +02:00
atafb.c video: fbdev: atari: Atari 2 bpp (STe) palette bugfix 2022-04-08 14:39:56 +02:00
atafb.h
…
atafb_iplan2p2.c
…
atafb_iplan2p4.c
…
atafb_iplan2p8.c
…
atafb_mfb.c
…
atafb_utils.h
…
atmel_lcdfb.c video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() 2022-04-08 14:40:06 +02:00
au1100fb.c
…
au1100fb.h
…
au1200fb.c
…
au1200fb.h
…
broadsheetfb.c
…
bt431.h
…
bt455.h
…
bw2.c
…
c2p.h
…
c2p_core.h
…
c2p_iplan2.c
…
c2p_planar.c
…
carminefb.c
…
carminefb.h
…
carminefb_regs.h
…
cg3.c
…
cg6.c
…
cg14.c
…
chipsfb.c video: fbdev: chipsfb: use memset_io() instead of memset() 2021-11-18 14:04:17 +01:00
cirrusfb.c video: fbdev: cirrusfb: check pixclock to avoid divide by zero 2022-04-08 14:40:34 +02:00
clps711x-fb.c
…
cobalt_lcdfb.c
…
controlfb.c video: fbdev: controlfb: Fix COMPILE_TEST build 2022-04-08 14:40:06 +02:00
controlfb.h
…
cyber2000fb.c
…
cyber2000fb.h
…
da8xx-fb.c
…
dnfb.c
…
edid.h
…
efifb.c
…
ep93xx-fb.c
…
ffb.c
…
fm2fb.c
…
fsl-diu-fb.c
…
g364fb.c
…
gbefb.c video: fbdev: gbefb: Only instantiate device when built for IP32 2021-10-13 10:04:28 +02:00
goldfishfb.c
…
grvga.c
…
gxt4500.c
…
hecubafb.c
…
hgafb.c video: hgafb: correctly handle card detect failure during probe 2021-05-26 12:06:57 +02:00
hitfb.c
…
hpfb.c
…
hyperv_fb.c video: hyperv_fb: Fix validation of screen resolution 2022-02-01 17:25:46 +01:00
i740_reg.h
…
i740fb.c
…
imsttfb.c Revert "video: imsttfb: fix potential NULL pointer dereferences" 2021-05-26 12:06:54 +02:00
imxfb.c video: fbdev: imxfb: Fix an error message 2021-07-14 16:56:15 +02:00
leo.c
…
macfb.c
…
macmodes.c
…
macmodes.h
…
maxinefb.c
…
metronomefb.c
…
mx3fb.c
…
n411.c
…
neofb.c
…
ocfb.c
…
offb.c
…
p9100.c
…
platinumfb.c
…
platinumfb.h
…
pm2fb.c
…
pm3fb.c
…
pmag-aa-fb.c
…
pmag-ba-fb.c
…
pmagb-b-fb.c
…
ps3fb.c
…
pvr2fb.c
…
pxa3xx-gcu.c
…
pxa3xx-gcu.h
…
pxa168fb.c
…
pxa168fb.h
…
pxafb.c
…
pxafb.h
…
q40fb.c
…
s1d13xxxfb.c
…
s3c-fb.c
…
s3c2410fb-regs-lcd.h
…
s3c2410fb.c
…
s3c2410fb.h
…
s3fb.c
…
sa1100fb.c
…
sa1100fb.h
…
sbuslib.c
…
sbuslib.h
…
sh7760fb.c
…
sh_mobile_lcdcfb.c
…
sh_mobile_lcdcfb.h
…
simplefb.c
…
skeletonfb.c
…
sm501fb.c
…
sm712.h
…
sm712fb.c video: fbdev: sm712fb: Fix crash in smtcfb_write() 2022-04-08 14:40:36 +02:00
smscufx.c video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() 2022-04-08 14:40:06 +02:00
ssd1307fb.c
…
sstfb.c
…
sticore.h
…
stifb.c
…
sunxvr500.c
…
sunxvr1000.c
…
sunxvr2500.c
…
tcx.c
…
tdfxfb.c
…
tgafb.c
…
tmiofb.c
…
tridentfb.c
…
udlfb.c video: fbdev: udlfb: properly check endpoint type 2022-05-09 09:05:00 +02:00
uvesafb.c
…
valkyriefb.c
…
valkyriefb.h
…
vesafb.c
…
vfb.c
…
vga16fb.c video: vga16fb: Only probe for EGA and VGA 16 color graphic cards 2022-01-20 09:17:50 +01:00
vt8500lcdfb.c
…
vt8500lcdfb.h
…
vt8623fb.c
…
w100fb.c video: fbdev: w100fb: Reset global state 2022-04-08 14:40:33 +02:00
w100fb.h
…
wm8505fb.c
…
wm8505fb_regs.h
…
wmt_ge_rops.c
…
wmt_ge_rops.h
…
xen-fbfront.c
…
xilinxfb.c
…