Skip to content

Commit ed9ed5a

Browse files
jhovoldgregkh
authored andcommitted
staging: gigaset: add endpoint-type sanity check
Add missing endpoint-type sanity checks to probe. This specifically prevents a warning in USB core on URB submission when fuzzing USB descriptors. Signed-off-by: Johan Hovold <[email protected]> Cc: stable <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent 84f60ca commit ed9ed5a

File tree

1 file changed

+12
-0
lines changed

1 file changed

+12
-0
lines changed

drivers/staging/isdn/gigaset/usb-gigaset.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -705,6 +705,12 @@ static int gigaset_probe(struct usb_interface *interface,
705705

706706
endpoint = &hostif->endpoint[0].desc;
707707

708+
if (!usb_endpoint_is_bulk_out(endpoint)) {
709+
dev_err(&interface->dev, "missing bulk-out endpoint\n");
710+
retval = -ENODEV;
711+
goto error;
712+
}
713+
708714
buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
709715
ucs->bulk_out_size = buffer_size;
710716
ucs->bulk_out_epnum = usb_endpoint_num(endpoint);
@@ -724,6 +730,12 @@ static int gigaset_probe(struct usb_interface *interface,
724730

725731
endpoint = &hostif->endpoint[1].desc;
726732

733+
if (!usb_endpoint_is_int_in(endpoint)) {
734+
dev_err(&interface->dev, "missing int-in endpoint\n");
735+
retval = -ENODEV;
736+
goto error;
737+
}
738+
727739
ucs->busy = 0;
728740

729741
ucs->read_urb = usb_alloc_urb(0, GFP_KERNEL);

0 commit comments

Comments
 (0)