* [PATCH] usbtmc: more sanity checking for packet size
@ 2019-08-20 9:28 Oliver Neukum
0 siblings, 0 replies; only message in thread
From: Oliver Neukum @ 2019-08-20 9:28 UTC (permalink / raw)
To: gregKH, linux-usb, guido.kiener, steve_bayless; +Cc: Oliver Neukum
A malicious device can make the driver divide ny zero
with a nonsense maximum packet size.
V2: return a sensible error code
SIgned-off-by: Oliver Neukum <oneukum@suse.com>
---
drivers/usb/class/usbtmc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index 4942122b2346..36858ddd8d9b 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -2362,8 +2362,11 @@ static int usbtmc_probe(struct usb_interface *intf,
goto err_put;
}
+ retcode = -EINVAL;
data->bulk_in = bulk_in->bEndpointAddress;
data->wMaxPacketSize = usb_endpoint_maxp(bulk_in);
+ if (!data->wMaxPacketSize)
+ goto err_put;
dev_dbg(&intf->dev, "Found bulk in endpoint at %u\n", data->bulk_in);
data->bulk_out = bulk_out->bEndpointAddress;
--
2.16.4
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2019-08-20 9:28 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-20 9:28 [PATCH] usbtmc: more sanity checking for packet size Oliver Neukum
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).