OpenSDV
/
original_kernel
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

media: iguanair: add sanity checks 

The driver needs to check the endpoint types, too, as opposed
to the number of endpoints. This also requires moving the check earlier.

Reported-by: syzbot+01a77b82edaa374068e1@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
This commit is contained in:
Oliver Neukum 2019-07-30 05:50:44 -03:00 committed by Mauro Carvalho Chehab
parent 7328d68237
commit ab1cbdf159
1 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/media/rc/iguanair.c
View File

@ -413,6 +413,10 @@ static int iguanair_probe(struct usb_interface *intf,
int ret, pipein, pipeout;
struct usb_host_interface *idesc;
idesc = intf->altsetting;
if (idesc->desc.bNumEndpoints < 2)
return -ENODEV;
ir = kzalloc(sizeof(*ir), GFP_KERNEL);
rc = rc_allocate_device(RC_DRIVER_IR_RAW);
if (!ir || !rc) {
@ -427,18 +431,13 @@ static int iguanair_probe(struct usb_interface *intf,
ir->urb_in = usb_alloc_urb(0, GFP_KERNEL);
ir->urb_out = usb_alloc_urb(0, GFP_KERNEL);
if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out) {
if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out ||
!usb_endpoint_is_int_in(&idesc->endpoint[0].desc) ||
!usb_endpoint_is_int_out(&idesc->endpoint[1].desc)) {
ret = -ENOMEM;
goto out;
}
idesc = intf->altsetting;
if (idesc->desc.bNumEndpoints < 2) {
ret = -ENODEV;
goto out;
}
ir->rc = rc;
ir->dev = &intf->dev;
ir->udev = udev;