executor, sys/linux: syz_usb_ep_read/write accept endpoint address

This patch changes syz_usb_ep_read/write pseudo-syscalls to accept endpoint
address as specified in its endpoint descriptor, instead of endpoint index.

8 files changed, 133 insertions, 41 deletions

diff --git a/executor/common_usb.h b/executor/common_usb.h
index 0722750b7..f14d6b9b1 100644
--- a/executor/common_usb.h
+++ b/executor/common_usb.h
@@ -9,20 +9,33 @@
 #define USB_MAX_EP_NUM 32
 #define USB_MAX_FDS 6
 
+struct usb_endpoint_index {
+	// Copy of the endpoint descriptor:
+	struct usb_endpoint_descriptor desc;
+	// Raw Gadget endpoint handle used for this endpoint (Linux only):
+	int handle;
+};
+
 struct usb_iface_index {
+	// Pointer to where the original interface descriptor is stored:
 	struct usb_interface_descriptor* iface;
+	// Cached copied of some of the interface attributes:
 	uint8 bInterfaceNumber;
 	uint8 bAlternateSetting;
 	uint8 bInterfaceClass;
-	struct usb_endpoint_descriptor eps[USB_MAX_EP_NUM];
+	// Endpoint indexes:
+	struct usb_endpoint_index eps[USB_MAX_EP_NUM];
 	int eps_num;
 };
 
 struct usb_device_index {
+	// Pointer to where the original descriptors are stored:
 	struct usb_device_descriptor* dev;
 	struct usb_config_descriptor* config;
+	// Cached copied of some of the device attributes:
 	uint8 bDeviceClass;
 	uint8 bMaxPower;
+	// Config and interface attributes/indexes:
 	int config_length;
 	struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
 	int ifaces_num;
@@ -75,7 +88,7 @@ static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_d
 			struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
 			debug("parse_usb_descriptor: found endpoint #%u at %p\n", iface->eps_num, buffer + offset);
 			if (iface->eps_num < USB_MAX_EP_NUM) {
-				memcpy(&iface->eps[iface->eps_num], buffer + offset, sizeof(iface->eps[iface->eps_num]));
+				memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
 				iface->eps_num++;
 			}
 		}
diff --git a/executor/common_usb_linux.h b/executor/common_usb_linux.h
index ff549b2d4..935b30df2 100644
--- a/executor/common_usb_linux.h
+++ b/executor/common_usb_linux.h
@@ -170,6 +170,24 @@ static int lookup_interface(int fd, uint8 bInterfaceNumber, uint8 bAlternateSett
 }
 #endif // SYZ_EXECUTOR || __NR_syz_usb_control_io
 
+#if SYZ_EXECUTOR || __NR_syz_usb_ep_write || __NR_syz_usb_ep_read
+static int lookup_endpoint(int fd, uint8 bEndpointAddress)
+{
+	struct usb_device_index* index = lookup_usb_index(fd);
+	int ep;
+
+	if (!index)
+		return -1;
+	if (index->iface_cur < 0)
+		return -1;
+
+	for (ep = 0; index->ifaces[index->iface_cur].eps_num; ep++)
+		if (index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress == bEndpointAddress)
+			return index->ifaces[index->iface_cur].eps[ep].handle;
+	return -1;
+}
+#endif // SYZ_EXECUTOR || __NR_syz_usb_ep_write || __NR_syz_usb_ep_read
+
 static void set_interface(int fd, int n)
 {
 	struct usb_device_index* index = lookup_usb_index(fd);
@@ -180,21 +198,26 @@ static void set_interface(int fd, int n)
 
 	if (index->iface_cur >= 0 && index->iface_cur < index->ifaces_num) {
 		for (ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) {
-			int rv = usb_raw_ep_disable(fd, ep);
+			int rv = usb_raw_ep_disable(fd, index->ifaces[index->iface_cur].eps[ep].handle);
 			if (rv < 0) {
-				debug("set_interface: failed to disable endpoint %d\n", ep);
+				debug("set_interface: failed to disable endpoint 0x%02x\n",
+				      index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress);
 			} else {
-				debug("set_interface: endpoint %d disabled\n", ep);
+				debug("set_interface: endpoint 0x%02x disabled\n",
+				      index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress);
 			}
 		}
 	}
 	if (n >= 0 && n < index->ifaces_num) {
 		for (ep = 0; ep < index->ifaces[n].eps_num; ep++) {
-			int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep]);
+			int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep].desc);
 			if (rv < 0) {
-				debug("set_interface: failed to enable endpoint %d\n", ep);
+				debug("set_interface: failed to enable endpoint 0x%02x\n",
+				      index->ifaces[n].eps[ep].desc.bEndpointAddress);
 			} else {
-				debug("set_interface: endpoint %d enabled as %d\n", ep, rv);
+				debug("set_interface: endpoint 0x%02x enabled as %d\n",
+				      index->ifaces[n].eps[ep].desc.bEndpointAddress, rv);
+				index->ifaces[n].eps[ep].handle = rv;
 			}
 		}
 		index->iface_cur = n;
@@ -496,12 +519,19 @@ static volatile long syz_usb_control_io(volatile long a0, volatile long a1, vola
 static volatile long syz_usb_ep_write(volatile long a0, volatile long a1, volatile long a2, volatile long a3)
 {
 	int fd = a0;
-	uint16 ep = a1;
+	uint8 ep = a1;
 	uint32 len = a2;
 	char* data = (char*)a3;
 
+	int ep_handle = lookup_endpoint(fd, ep);
+	if (ep_handle < 0) {
+		debug("syz_usb_ep_write: endpoint not found\n");
+		return -1;
+	}
+	debug("syz_usb_ep_write: endpoint handle: %d\n", ep_handle);
+
 	struct usb_raw_ep_io_data io_data;
-	io_data.inner.ep = ep;
+	io_data.inner.ep = ep_handle;
 	io_data.inner.flags = 0;
 	if (len > sizeof(io_data.data))
 		len = sizeof(io_data.data);
@@ -524,12 +554,19 @@ static volatile long syz_usb_ep_write(volatile long a0, volatile long a1, volati
 static volatile long syz_usb_ep_read(volatile long a0, volatile long a1, volatile long a2, volatile long a3)
 {
 	int fd = a0;
-	uint16 ep = a1;
+	uint8 ep = a1;
 	uint32 len = a2;
 	char* data = (char*)a3;
 
+	int ep_handle = lookup_endpoint(fd, ep);
+	if (ep_handle < 0) {
+		debug("syz_usb_ep_read: endpoint not found\n");
+		return -1;
+	}
+	debug("syz_usb_ep_read: endpoint handle: %d\n", ep_handle);
+
 	struct usb_raw_ep_io_data io_data;
-	io_data.inner.ep = ep;
+	io_data.inner.ep = ep_handle;
 	io_data.inner.flags = 0;
 	if (len > sizeof(io_data.data))
 		len = sizeof(io_data.data);
diff --git a/pkg/csource/generated.go b/pkg/csource/generated.go
index e2b61d070..8d1c8e6ce 100644
--- a/pkg/csource/generated.go
+++ b/pkg/csource/generated.go
@@ -2430,12 +2430,17 @@ static long syz_extract_tcp_res(volatile long a0, volatile long a1, volatile lon
 #define USB_MAX_EP_NUM 32
 #define USB_MAX_FDS 6
 
+struct usb_endpoint_index {
+	struct usb_endpoint_descriptor desc;
+	int handle;
+};
+
 struct usb_iface_index {
 	struct usb_interface_descriptor* iface;
 	uint8 bInterfaceNumber;
 	uint8 bAlternateSetting;
 	uint8 bInterfaceClass;
-	struct usb_endpoint_descriptor eps[USB_MAX_EP_NUM];
+	struct usb_endpoint_index eps[USB_MAX_EP_NUM];
 	int eps_num;
 };
 
@@ -2496,7 +2501,7 @@ static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_d
 			struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
 			debug("parse_usb_descriptor: found endpoint #%u at %p\n", iface->eps_num, buffer + offset);
 			if (iface->eps_num < USB_MAX_EP_NUM) {
-				memcpy(&iface->eps[iface->eps_num], buffer + offset, sizeof(iface->eps[iface->eps_num]));
+				memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
 				iface->eps_num++;
 			}
 		}
@@ -3364,6 +3369,24 @@ static int lookup_interface(int fd, uint8 bInterfaceNumber, uint8 bAlternateSett
 }
 #endif
 
+#if SYZ_EXECUTOR || __NR_syz_usb_ep_write || __NR_syz_usb_ep_read
+static int lookup_endpoint(int fd, uint8 bEndpointAddress)
+{
+	struct usb_device_index* index = lookup_usb_index(fd);
+	int ep;
+
+	if (!index)
+		return -1;
+	if (index->iface_cur < 0)
+		return -1;
+
+	for (ep = 0; index->ifaces[index->iface_cur].eps_num; ep++)
+		if (index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress == bEndpointAddress)
+			return index->ifaces[index->iface_cur].eps[ep].handle;
+	return -1;
+}
+#endif
+
 static void set_interface(int fd, int n)
 {
 	struct usb_device_index* index = lookup_usb_index(fd);
@@ -3374,21 +3397,26 @@ static void set_interface(int fd, int n)
 
 	if (index->iface_cur >= 0 && index->iface_cur < index->ifaces_num) {
 		for (ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) {
-			int rv = usb_raw_ep_disable(fd, ep);
+			int rv = usb_raw_ep_disable(fd, index->ifaces[index->iface_cur].eps[ep].handle);
 			if (rv < 0) {
-				debug("set_interface: failed to disable endpoint %d\n", ep);
+				debug("set_interface: failed to disable endpoint 0x%02x\n",
+				      index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress);
 			} else {
-				debug("set_interface: endpoint %d disabled\n", ep);
+				debug("set_interface: endpoint 0x%02x disabled\n",
+				      index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress);
 			}
 		}
 	}
 	if (n >= 0 && n < index->ifaces_num) {
 		for (ep = 0; ep < index->ifaces[n].eps_num; ep++) {
-			int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep]);
+			int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep].desc);
 			if (rv < 0) {
-				debug("set_interface: failed to enable endpoint %d\n", ep);
+				debug("set_interface: failed to enable endpoint 0x%02x\n",
+				      index->ifaces[n].eps[ep].desc.bEndpointAddress);
 			} else {
-				debug("set_interface: endpoint %d enabled as %d\n", ep, rv);
+				debug("set_interface: endpoint 0x%02x enabled as %d\n",
+				      index->ifaces[n].eps[ep].desc.bEndpointAddress, rv);
+				index->ifaces[n].eps[ep].handle = rv;
 			}
 		}
 		index->iface_cur = n;
@@ -3686,12 +3714,19 @@ static volatile long syz_usb_control_io(volatile long a0, volatile long a1, vola
 static volatile long syz_usb_ep_write(volatile long a0, volatile long a1, volatile long a2, volatile long a3)
 {
 	int fd = a0;
-	uint16 ep = a1;
+	uint8 ep = a1;
 	uint32 len = a2;
 	char* data = (char*)a3;
 
+	int ep_handle = lookup_endpoint(fd, ep);
+	if (ep_handle < 0) {
+		debug("syz_usb_ep_write: endpoint not found\n");
+		return -1;
+	}
+	debug("syz_usb_ep_write: endpoint handle: %d\n", ep_handle);
+
 	struct usb_raw_ep_io_data io_data;
-	io_data.inner.ep = ep;
+	io_data.inner.ep = ep_handle;
 	io_data.inner.flags = 0;
 	if (len > sizeof(io_data.data))
 		len = sizeof(io_data.data);
@@ -3714,12 +3749,19 @@ static volatile long syz_usb_ep_write(volatile long a0, volatile long a1, volati
 static volatile long syz_usb_ep_read(volatile long a0, volatile long a1, volatile long a2, volatile long a3)
 {
 	int fd = a0;
-	uint16 ep = a1;
+	uint8 ep = a1;
 	uint32 len = a2;
 	char* data = (char*)a3;
 
+	int ep_handle = lookup_endpoint(fd, ep);
+	if (ep_handle < 0) {
+		debug("syz_usb_ep_read: endpoint not found\n");
+		return -1;
+	}
+	debug("syz_usb_ep_read: endpoint handle: %d\n", ep_handle);
+
 	struct usb_raw_ep_io_data io_data;
-	io_data.inner.ep = ep;
+	io_data.inner.ep = ep_handle;
 	io_data.inner.flags = 0;
 	if (len > sizeof(io_data.data))
 		len = sizeof(io_data.data);
diff --git a/sys/linux/test/vusb_ath9k b/sys/linux/test/vusb_ath9k
index bd095a9cb..a728664f0 100644
--- a/sys/linux/test/vusb_ath9k
+++ b/sys/linux/test/vusb_ath9k
@@ -1,4 +1,4 @@
 # requires: -repeat
 
 r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48, 0x1, 0x1, 0x0, 0x80, 0xfa, {{0x9, 0x4, 0x0, 0x0, 0x6, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x1, 0x2, 0x200, 0x0, 0x0, 0x0, ""}, {0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x0, 0x0, ""}, {0x9, 0x5, 0x83, 0x3, 0x40, 0x1, 0x0, 0x0, ""}, {0x9, 0x5, 0x4, 0x3, 0x40, 0x1, 0x0, 0x0, ""}, {0x9, 0x5, 0x5, 0x2, 0x200, 0x0, 0x0, 0x0, ""}, {0x9, 0x5, 0x6, 0x2, 0x200, 0x0, 0x0, 0x0, ""}}}}}}]}}, 0x0)
-syz_usb_ep_write$ath9k_ep2(r0, 0x2, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB', {0x1, 0x0, 0x0, 0x0, 0x0}})
+syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB', {0x1, 0x0, 0x0, 0x0, 0x0}})
diff --git a/sys/linux/test/vusb_cdc_ecm b/sys/linux/test/vusb_cdc_ecm
index 848158cc4..d6997255c 100644
--- a/sys/linux/test/vusb_cdc_ecm
+++ b/sys/linux/test/vusb_cdc_ecm
@@ -4,4 +4,4 @@ r0 = syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2,
 syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
 syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
 syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a, 0x3, {0x3400320034003200, 0x3400320034003200, 0x3400320034003200}}}}, 0x0)
-syz_usb_ep_write(r0, 0x0, 0x5, &(0x7f0000002340)='hello')
+syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello')
diff --git a/sys/linux/test/vusb_cdc_ncm b/sys/linux/test/vusb_cdc_ncm
index f360a6dd3..4ffdb5efa 100644
--- a/sys/linux/test/vusb_cdc_ncm
+++ b/sys/linux/test/vusb_cdc_ncm
@@ -6,4 +6,4 @@ syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
 syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0})
 syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
 syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a, 0x3, {0x3400320034003200, 0x3400320034003200, 0x3400320034003200}}}}, 0x0)
-syz_usb_ep_write(r0, 0x0, 0x5, &(0x7f0000002340)='hello')
+syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello')
diff --git a/sys/linux/test/vusb_hid b/sys/linux/test/vusb_hid
index de77a8dc2..b092470f9 100644
--- a/sys/linux/test/vusb_hid
+++ b/sys/linux/test/vusb_hid
@@ -3,6 +3,6 @@
 r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0)
 syz_usb_control_io$hid(r0, 0x0, 0x0)
 syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8, '\x00'}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0)
-syz_usb_ep_write(r0, 0x0, 0x7, &(0x7f0000000000)='BBBBBBB')
-syz_usb_ep_write(r0, 0x0, 0x7, &(0x7f0000000000)='BBBBBBB')
-syz_usb_ep_write(r0, 0x0, 0x7, &(0x7f0000000000)='BBBBBBB')
+syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB')
+syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB')
+syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB')
diff --git a/sys/linux/vusb.txt b/sys/linux/vusb.txt
index af3bb02db..4597bce93 100644
--- a/sys/linux/vusb.txt
+++ b/sys/linux/vusb.txt
@@ -24,8 +24,8 @@ resource fd_usb[int32]: -1
 # They are mostly targeted to cover the enumeration process.
 syz_usb_connect(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb (timeout[3000], prog_timeout[3000])
 syz_usb_control_io(fd fd_usb, descs ptr[in, vusb_descriptors], resps ptr[in, vusb_responses]) (timeout[300])
-syz_usb_ep_write(fd fd_usb, ep int16[0:31], len len[data], data ptr[in, array[int8, 0:256]]) (timeout[300])
-syz_usb_ep_read(fd fd_usb, ep int16[0:31], len len[data], data buffer[out]) (timeout[300])
+syz_usb_ep_write(fd fd_usb, ep int8, len len[data], data ptr[in, array[int8, 0:256]]) (timeout[300])
+syz_usb_ep_read(fd fd_usb, ep int8, len len[data], data buffer[out]) (timeout[300])
 syz_usb_disconnect(fd fd_usb) (timeout[300])
 
 usb_device_speed = USB_SPEED_UNKNOWN, USB_SPEED_LOW, USB_SPEED_FULL, USB_SPEED_HIGH, USB_SPEED_WIRELESS, USB_SPEED_SUPER, USB_SPEED_SUPER_PLUS
@@ -1334,11 +1334,18 @@ vusb_responses_uac1 {
 include <drivers/net/wireless/ath/ath9k/htc_hst.h>
 include <drivers/net/wireless/ath/ath9k/hif_usb.h>
 
+define USB_ENDPOINT_ATH9K_BULK_OUT_ADDRESS	(1)
+define USB_ENDPOINT_ATH9K_BULK_IN_ADDRESS	(2 | USB_DIR_IN)
+define USB_ENDPOINT_ATH9K_INT_IN_ADDRESS	(3 | USB_DIR_IN)
+define USB_ENDPOINT_ATH9K_INT_OUT_ADDRESS	(4)
+define USB_ENDPOINT_ATH9K_BULK_EXTRA1_ADDRESS	(5)
+define USB_ENDPOINT_ATH9K_BULK_EXTRA2_ADDRESS	(6)
+
 resource fd_usb_ath9k[fd_usb]
 
 syz_usb_connect_ath9k(speed const[USB_SPEED_HIGH], dev_len len[dev], dev ptr[in, usb_device_descriptor_ath9k], conn_descs const[0]) fd_usb_ath9k (timeout[3000], prog_timeout[3000])
-syz_usb_ep_write$ath9k_ep1(fd fd_usb_ath9k, ep const[0x1], len bytesize[data], data ptr[in, ath9k_bulk_frame]) (timeout[300])
-syz_usb_ep_write$ath9k_ep2(fd fd_usb_ath9k, ep const[0x2], len bytesize[data], data ptr[in, htc_frame]) (timeout[300])
+syz_usb_ep_write$ath9k_ep1(fd fd_usb_ath9k, ep const[USB_ENDPOINT_ATH9K_BULK_IN_ADDRESS], len bytesize[data], data ptr[in, ath9k_bulk_frame]) (timeout[300])
+syz_usb_ep_write$ath9k_ep2(fd fd_usb_ath9k, ep const[USB_ENDPOINT_ATH9K_INT_IN_ADDRESS], len bytesize[data], data ptr[in, htc_frame]) (timeout[300])
 
 usb_device_descriptor_ath9k {
 	inner	usb_device_descriptor_fixed_t[0x200, USB_CLASS_VENDOR_SPEC, USB_SUBCLASS_VENDOR_SPEC, 0xff, 64, 0xcf3, 0x9271, 0x108, array[usb_config_descriptor_ath9k, 1]]
@@ -1361,13 +1368,6 @@ usb_endpoint_descriptors_ath9k {
 	bulk_extra2	usb_endpoint_descriptor_fixed_t[USB_ENDPOINT_ATH9K_BULK_EXTRA2_ADDRESS, USB_ENDPOINT_ATH9K_BULK_ATTRIBUTES, 512, 0, void]
 } [packed]
 
-define USB_ENDPOINT_ATH9K_BULK_OUT_ADDRESS	(1)
-define USB_ENDPOINT_ATH9K_BULK_IN_ADDRESS	(2 | USB_DIR_IN)
-define USB_ENDPOINT_ATH9K_INT_IN_ADDRESS	(3 | USB_DIR_IN)
-define USB_ENDPOINT_ATH9K_INT_OUT_ADDRESS	(4)
-define USB_ENDPOINT_ATH9K_BULK_EXTRA1_ADDRESS	(5)
-define USB_ENDPOINT_ATH9K_BULK_EXTRA2_ADDRESS	(6)
-
 define USB_ENDPOINT_ATH9K_BULK_ATTRIBUTES	(USB_ENDPOINT_XFER_BULK)
 define USB_ENDPOINT_ATH9K_INT_ATTRIBUTES	(USB_ENDPOINT_XFER_INT)