Skip to content

Commit

Permalink
media: iguanair: add sanity checks
Browse files Browse the repository at this point in the history
The driver needs to check the endpoint types, too, as opposed
to the number of endpoints. This also requires moving the check earlier.

Reported-by: syzbot+01a77b82edaa374068e1@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
  • Loading branch information
Oliver Neukum authored and Mauro Carvalho Chehab committed Aug 4, 2019
1 parent 7328d68 commit ab1cbdf
Showing 1 changed file with 7 additions and 8 deletions.
15 changes: 7 additions & 8 deletions drivers/media/rc/iguanair.c
Original file line number Diff line number Diff line change
Expand Up @@ -413,6 +413,10 @@ static int iguanair_probe(struct usb_interface *intf,
int ret, pipein, pipeout;
struct usb_host_interface *idesc;

idesc = intf->altsetting;
if (idesc->desc.bNumEndpoints < 2)
return -ENODEV;

ir = kzalloc(sizeof(*ir), GFP_KERNEL);
rc = rc_allocate_device(RC_DRIVER_IR_RAW);
if (!ir || !rc) {
Expand All @@ -427,18 +431,13 @@ static int iguanair_probe(struct usb_interface *intf,
ir->urb_in = usb_alloc_urb(0, GFP_KERNEL);
ir->urb_out = usb_alloc_urb(0, GFP_KERNEL);

if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out) {
if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out ||
!usb_endpoint_is_int_in(&idesc->endpoint[0].desc) ||
!usb_endpoint_is_int_out(&idesc->endpoint[1].desc)) {
ret = -ENOMEM;
goto out;
}

idesc = intf->altsetting;

if (idesc->desc.bNumEndpoints < 2) {
ret = -ENODEV;
goto out;
}

ir->rc = rc;
ir->dev = &intf->dev;
ir->udev = udev;
Expand Down

0 comments on commit ab1cbdf

Please sign in to comment.