commit 665c365a77fbfeabe52694aedf3446d5f2f1ce42
author Alan Stern <stern@rowland.harvard.edu> Mon Oct 15 16:55:04 2018 -0400
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> Tue Oct 16 13:09:36 2018 +0200
tree ff6a03294a000077f970491d8e6db196b99b1ff2
parent c02588a352defaf985fc1816eb6232663159e1b8

USB: fix the usbfs flag sanitization for control transfers

Commit 7a68d9fb8510 ("USB: usbdevfs: sanitize flags more") checks the
transfer flags for URBs submitted from userspace via usbfs.  However,
the check for whether the USBDEVFS_URB_SHORT_NOT_OK flag should be
allowed for a control transfer was added in the wrong place, before
the code has properly determined the direction of the control
transfer.  (Control transfers are special because for them, the
direction is set by the bRequestType byte of the Setup packet rather
than direction bit of the endpoint address.)

This patch moves code which sets up the allow_short flag for control
transfers down after is_in has been set to the correct value.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+24a30223a4b609bb802e@syzkaller.appspotmail.com
Fixes: 7a68d9fb8510 ("USB: usbdevfs: sanitize flags more")
CC: Oliver Neukum <oneukum@suse.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>