| Message ID | 20191210114426.4713-2-johan@kernel.org |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | David Miller |
| Headers | show |
| Series | wireless: fix USB altsetting bugs | expand |
Johan Hovold <johan@kernel.org> wrote: > Make sure to use the current alternate setting when verifying the > storage interface descriptors to avoid submitting an URB to an invalid > endpoint. > > Failing to do so could cause the driver to misbehave or trigger a WARN() > in usb_submit_urb() that kernels with panic_on_warn set would choke on. > > Fixes: 36bcce430657 ("ath9k_htc: Handle storage devices") > Cc: stable <stable@vger.kernel.org> # 2.6.39 > Signed-off-by: Johan Hovold <johan@kernel.org> > Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Patch applied to ath-next branch of ath.git, thanks. 0ef332951e85 ath9k: fix storage endpoint lookup
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index fb649d85b8fc..dd0c32379375 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -1216,7 +1216,7 @@ static void ath9k_hif_usb_firmware_cb(const struct firmware *fw, void *context) static int send_eject_command(struct usb_interface *interface) { struct usb_device *udev = interface_to_usbdev(interface); - struct usb_host_interface *iface_desc = &interface->altsetting[0]; + struct usb_host_interface *iface_desc = interface->cur_altsetting; struct usb_endpoint_descriptor *endpoint; unsigned char *cmd; u8 bulk_out_ep;
Make sure to use the current alternate setting when verifying the storage interface descriptors to avoid submitting an URB to an invalid endpoint. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: 36bcce430657 ("ath9k_htc: Handle storage devices") Cc: stable <stable@vger.kernel.org> # 2.6.39 Signed-off-by: Johan Hovold <johan@kernel.org> --- drivers/net/wireless/ath/ath9k/hif_usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)