* [PATCH] mfd: dln2: more sanity checking for endpoints
@ 2019-11-21 10:28 Oliver Neukum
2019-12-13 10:29 ` Lee Jones
0 siblings, 1 reply; 2+ messages in thread
From: Oliver Neukum @ 2019-11-21 10:28 UTC (permalink / raw)
To: lee.jones, gregkh, linux-usb; +Cc: Oliver Neukum
It is not enough to check for the number of endpoints.
The types must also be correct.
Reported-and-tested-by: syzbot+48a2851be24583b864dc@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
drivers/mfd/dln2.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c
index 381593fbe50f..7841c11411d0 100644
--- a/drivers/mfd/dln2.c
+++ b/drivers/mfd/dln2.c
@@ -722,6 +722,8 @@ static int dln2_probe(struct usb_interface *interface,
const struct usb_device_id *usb_id)
{
struct usb_host_interface *hostif = interface->cur_altsetting;
+ struct usb_endpoint_descriptor *epin;
+ struct usb_endpoint_descriptor *epout;
struct device *dev = &interface->dev;
struct dln2_dev *dln2;
int ret;
@@ -731,12 +733,19 @@ static int dln2_probe(struct usb_interface *interface,
hostif->desc.bNumEndpoints < 2)
return -ENODEV;
+ epin = &hostif->endpoint[0].desc;
+ epout = &hostif->endpoint[1].desc;
+ if (!usb_endpoint_is_bulk_out(epout))
+ return -ENODEV;
+ if (!usb_endpoint_is_bulk_in(epin))
+ return -ENODEV;
+
dln2 = kzalloc(sizeof(*dln2), GFP_KERNEL);
if (!dln2)
return -ENOMEM;
- dln2->ep_out = hostif->endpoint[0].desc.bEndpointAddress;
- dln2->ep_in = hostif->endpoint[1].desc.bEndpointAddress;
+ dln2->ep_out = epout->bEndpointAddress;
+ dln2->ep_in = epin->bEndpointAddress;
dln2->usb_dev = usb_get_dev(interface_to_usbdev(interface));
dln2->interface = interface;
usb_set_intfdata(interface, dln2);
--
2.16.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] mfd: dln2: more sanity checking for endpoints
2019-11-21 10:28 [PATCH] mfd: dln2: more sanity checking for endpoints Oliver Neukum
@ 2019-12-13 10:29 ` Lee Jones
0 siblings, 0 replies; 2+ messages in thread
From: Lee Jones @ 2019-12-13 10:29 UTC (permalink / raw)
To: Oliver Neukum; +Cc: gregkh, linux-usb
On Thu, 21 Nov 2019, Oliver Neukum wrote:
> It is not enough to check for the number of endpoints.
> The types must also be correct.
>
> Reported-and-tested-by: syzbot+48a2851be24583b864dc@syzkaller.appspotmail.com
> Signed-off-by: Oliver Neukum <oneukum@suse.com>
> ---
> drivers/mfd/dln2.c | 13 +++++++++++--
> 1 file changed, 11 insertions(+), 2 deletions(-)
Applied with Greg's Ack, thanks.
--
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-12-13 10:29 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-21 10:28 [PATCH] mfd: dln2: more sanity checking for endpoints Oliver Neukum
2019-12-13 10:29 ` Lee Jones
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.