| Message ID | 20190725095158.7420-1-oneukum@suse.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | c88090dfc84254fa149174eb3e6a8458de1912c4 |
| Headers | show |
| Series | kbtab: sanity check for endpoint type | expand |
On Thu, Jul 25, 2019 at 11:51:58AM +0200, Oliver Neukum wrote: > The driver should check whether the endpoint it uses has the correct > type. > > Reported-by: syzbot+c7df50363aaff50aa363@syzkaller.appspotmail.com > Signed-off-by: Oliver Neukum <oneukum@suse.com> Applied, thank you. > --- > drivers/input/tablet/kbtab.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c > index 04b85571f41e..6f3b59ea2cd4 100644 > --- a/drivers/input/tablet/kbtab.c > +++ b/drivers/input/tablet/kbtab.c > @@ -116,6 +116,9 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i > > if (intf->cur_altsetting->desc.bNumEndpoints < 1) > return -ENODEV; > + endpoint = &intf->cur_altsetting->endpoint[0].desc; > + if (!usb_endpoint_is_int_in(endpoint)) > + return -ENODEV; > > kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL); > input_dev = input_allocate_device(); > @@ -155,8 +158,6 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i > input_set_abs_params(input_dev, ABS_Y, 0, 0x1750, 4, 0); > input_set_abs_params(input_dev, ABS_PRESSURE, 0, 0xff, 0, 0); > > - endpoint = &intf->cur_altsetting->endpoint[0].desc; > - > usb_fill_int_urb(kbtab->irq, dev, > usb_rcvintpipe(dev, endpoint->bEndpointAddress), > kbtab->data, 8, > -- > 2.16.4 >
diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c index 04b85571f41e..6f3b59ea2cd4 100644 --- a/drivers/input/tablet/kbtab.c +++ b/drivers/input/tablet/kbtab.c @@ -116,6 +116,9 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i if (intf->cur_altsetting->desc.bNumEndpoints < 1) return -ENODEV; + endpoint = &intf->cur_altsetting->endpoint[0].desc; + if (!usb_endpoint_is_int_in(endpoint)) + return -ENODEV; kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL); input_dev = input_allocate_device(); @@ -155,8 +158,6 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i input_set_abs_params(input_dev, ABS_Y, 0, 0x1750, 4, 0); input_set_abs_params(input_dev, ABS_PRESSURE, 0, 0xff, 0, 0); - endpoint = &intf->cur_altsetting->endpoint[0].desc; - usb_fill_int_urb(kbtab->irq, dev, usb_rcvintpipe(dev, endpoint->bEndpointAddress), kbtab->data, 8,
The driver should check whether the endpoint it uses has the correct type. Reported-by: syzbot+c7df50363aaff50aa363@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum <oneukum@suse.com> --- drivers/input/tablet/kbtab.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)