| Message ID | 1589463989-30029-4-git-send-email-christian.gromm@microchip.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | staging: most: usb: fix issues found in code audit | expand |
On Thu, May 14, 2020 at 03:46:25PM +0200, Christian Gromm wrote: > This patch checks the number of endpoints reported by the USB > interface descriptor and throws an error if the number exceeds > MAX_NUM_ENDPOINTS. > > Signed-off-by: Christian Gromm <christian.gromm@microchip.com> > Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > --- > drivers/staging/most/usb/usb.c | 13 ++++++------- > 1 file changed, 6 insertions(+), 7 deletions(-) This is a bugfix that should get backported to stable kernels, right? thanks, greg k-h
On Thu, 2020-05-14 at 16:06 +0200, Greg KH wrote: > EXTERNAL EMAIL: Do not click links or open attachments unless you > know the content is safe > > On Thu, May 14, 2020 at 03:46:25PM +0200, Christian Gromm wrote: > > This patch checks the number of endpoints reported by the USB > > interface descriptor and throws an error if the number exceeds > > MAX_NUM_ENDPOINTS. > > > > Signed-off-by: Christian Gromm <christian.gromm@microchip.com> > > Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > > --- > > drivers/staging/most/usb/usb.c | 13 ++++++------- > > 1 file changed, 6 insertions(+), 7 deletions(-) > > This is a bugfix that should get backported to stable kernels, right? > Right. I already sent out a v2 of the series. Should I resend? thanks, Chris
diff --git a/drivers/staging/most/usb/usb.c b/drivers/staging/most/usb/usb.c index 76963c0..25e114d 100644 --- a/drivers/staging/most/usb/usb.c +++ b/drivers/staging/most/usb/usb.c @@ -1045,13 +1045,17 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id) unsigned int num_endpoints; struct most_channel_capability *tmp_cap; struct usb_endpoint_descriptor *ep_desc; - int ret = 0; + int ret; if (!mdev) - goto err_out_of_memory; + return -ENOMEM; usb_set_intfdata(interface, mdev); num_endpoints = usb_iface_desc->desc.bNumEndpoints; + if (num_endpoints > MAX_NUM_ENDPOINTS) { + kfree(mdev); + return -EINVAL; + } mutex_init(&mdev->io_mutex); INIT_WORK(&mdev->poll_work_obj, wq_netinfo); timer_setup(&mdev->link_stat_timer, link_stat_timer_handler, 0); @@ -1180,11 +1184,6 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id) kfree(mdev->conf); err_free_mdev: put_device(&mdev->dev); -err_out_of_memory: - if (ret == 0 || ret == -ENOMEM) { - ret = -ENOMEM; - dev_err(dev, "out of memory\n"); - } return ret; }
This patch checks the number of endpoints reported by the USB interface descriptor and throws an error if the number exceeds MAX_NUM_ENDPOINTS. Signed-off-by: Christian Gromm <christian.gromm@microchip.com> Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/staging/most/usb/usb.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)