[SRU][B][PATCH 1/4] USB: move snd_usb_pipe_sanity_check into the USB core

[Magali Lemes]

From: Greg Kroah-Hartman <gregkh at linuxfoundation.org>

snd_usb_pipe_sanity_check() is a great function, so let's move it into
the USB core so that other parts of the kernel, including the USB core,
can call it.

Name it usb_pipe_type_check() to match the existing
usb_urb_ep_type_check() call, which now uses this function.

Cc: Jaroslav Kysela <perex at perex.cz>
Cc: "Gustavo A. R. Silva" <gustavoars at kernel.org>
Cc: Eli Billauer <eli.billauer at gmail.com>
Cc: Emiliano Ingrassia <ingrassia at epigenesys.com>
Cc: Alan Stern <stern at rowland.harvard.edu>
Cc: Alexander Tsoy <alexander at tsoy.me>
Cc: "Geoffrey D. Bennett" <g at b4.vu>
Cc: Jussi Laako <jussi at sonarnerd.net>
Cc: Nick Kossifidis <mickflemm at gmail.com>
Cc: Dmitry Panchenko <dmitry at d-systems.ee>
Cc: Chris Wulff <crwulff at gmail.com>
Cc: Jesus Ramos <jesus-ramos at live.com>
Reviewed-by: Takashi Iwai <tiwai at suse.de>
Link: https://lore.kernel.org/r/20200914153756.3412156-2-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
CVE-2022-3903
(backported from commit fcc2cc1f35613c016e1de25bb001bfdd9eaa25f9)
[magalilemes: We are not actually moving snd_usb_pipe_sanity_check(), as it
didn't exist yet in bionic. So, we are simply defining usb_pipe_type_check().]
Signed-off-by: Magali Lemes <magali.lemes at canonical.com>
---
 drivers/usb/core/urb.c | 31 +++++++++++++++++++++++--------
 include/linux/usb.h    |  1 +
 2 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index 5ac3ba322b02..567a4a59583d 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -193,24 +193,39 @@ static const int pipetypes[4] = {
 };
 
 /**
- * usb_urb_ep_type_check - sanity check of endpoint in the given urb
- * @urb: urb to be checked
+ * usb_pipe_type_check - sanity check of a specific pipe for a usb device
+ * @dev: struct usb_device to be checked
+ * @pipe: pipe to check
  *
  * This performs a light-weight sanity check for the endpoint in the
- * given urb.  It returns 0 if the urb contains a valid endpoint, otherwise
- * a negative error code.
+ * given usb device.  It returns 0 if the pipe is valid for the specific usb
+ * device, otherwise a negative error code.
  */
-int usb_urb_ep_type_check(const struct urb *urb)
+int usb_pipe_type_check(struct usb_device *dev, unsigned int pipe)
 {
 	const struct usb_host_endpoint *ep;
 
-	ep = usb_pipe_endpoint(urb->dev, urb->pipe);
+	ep = usb_pipe_endpoint(dev, pipe);
 	if (!ep)
 		return -EINVAL;
-	if (usb_pipetype(urb->pipe) != pipetypes[usb_endpoint_type(&ep->desc)])
+	if (usb_pipetype(pipe) != pipetypes[usb_endpoint_type(&ep->desc)])
 		return -EINVAL;
 	return 0;
 }
+EXPORT_SYMBOL_GPL(usb_pipe_type_check);
+
+/**
+ * usb_urb_ep_type_check - sanity check of endpoint in the given urb
+ * @urb: urb to be checked
+ *
+ * This performs a light-weight sanity check for the endpoint in the
+ * given urb.  It returns 0 if the urb contains a valid endpoint, otherwise
+ * a negative error code.
+ */
+int usb_urb_ep_type_check(const struct urb *urb)
+{
+	return usb_pipe_type_check(urb->dev, urb->pipe);
+}
 EXPORT_SYMBOL_GPL(usb_urb_ep_type_check);
 
 /**
@@ -467,7 +482,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
 	 */
 
 	/* Check that the pipe's type matches the endpoint's type */
-	if (usb_urb_ep_type_check(urb))
+	if (usb_pipe_type_check(urb->dev, urb->pipe))
 		dev_WARN(&dev->dev, "BOGUS urb xfer, pipe %x != type %x\n",
 			usb_pipetype(urb->pipe), pipetypes[xfertype]);
 
diff --git a/include/linux/usb.h b/include/linux/usb.h
index ed30da84996f..4f358538b518 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1729,6 +1729,7 @@ static inline int usb_urb_dir_out(struct urb *urb)
 	return (urb->transfer_flags & URB_DIR_MASK) == URB_DIR_OUT;
 }
 
+int usb_pipe_type_check(struct usb_device *dev, unsigned int pipe);
 int usb_urb_ep_type_check(const struct urb *urb);
 
 void *usb_alloc_coherent(struct usb_device *dev, size_t size,
-- 
2.34.1