Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 58079da9 authored by Oliver Neukum's avatar Oliver Neukum Committed by Greg Kroah-Hartman
Browse files

media: iguanair: add sanity checks 



[ Upstream commit ab1cbdf159beba7395a13ab70bc71180929ca064 ]

The driver needs to check the endpoint types, too, as opposed
to the number of endpoints. This also requires moving the check earlier.

Reported-by: default avatar <syzbot+01a77b82edaa374068e1@syzkaller.appspotmail.com>
Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent dfc2c4a3

drivers/media/rc/iguanair.c

+7 −8
Original line number Diff line number Diff line
@@ -430,6 +430,10 @@ static int iguanair_probe(struct usb_interface *intf, 
	int ret, pipein, pipeout;

	struct usb_host_interface *idesc;



	idesc = intf->altsetting;

	if (idesc->desc.bNumEndpoints < 2)

		return -ENODEV;



	ir = kzalloc(sizeof(*ir), GFP_KERNEL);

	rc = rc_allocate_device();

	if (!ir || !rc) {
@@ -444,18 +448,13 @@ static int iguanair_probe(struct usb_interface *intf, 
	ir->urb_in = usb_alloc_urb(0, GFP_KERNEL);

	ir->urb_out = usb_alloc_urb(0, GFP_KERNEL);



	if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out) {

	if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out ||

	    !usb_endpoint_is_int_in(&idesc->endpoint[0].desc) ||

	    !usb_endpoint_is_int_out(&idesc->endpoint[1].desc)) {

		ret = -ENOMEM;

		goto out;

	}



	idesc = intf->altsetting;



	if (idesc->desc.bNumEndpoints < 2) {

		ret = -ENODEV;

		goto out;

	}



	ir->rc = rc;

	ir->dev = &intf->dev;

	ir->udev = udev;