Commit c1a57be0 authored by Christian Gromm's avatar Christian Gromm Committed by Greg Kroah-Hartman
Browse files

staging: most: usb: check number of reported endpoints 



This patch checks the number of endpoints reported by the USB
interface descriptor and throws an error if the number exceeds
MAX_NUM_ENDPOINTS.

Signed-off-by: default avatarChristian Gromm <christian.gromm@microchip.com>
Reported-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/1589534465-7423-4-git-send-email-christian.gromm@microchip.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent bffea154

drivers/staging/most/usb/usb.c

+6 −7
Original line number Original line Diff line number Diff line
@@ -950,13 +950,17 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id) 
	unsigned int num_endpoints;

	unsigned int num_endpoints;

	struct most_channel_capability *tmp_cap;

	struct most_channel_capability *tmp_cap;

	struct usb_endpoint_descriptor *ep_desc;

	struct usb_endpoint_descriptor *ep_desc;

	int ret = 0;

	int ret = -ENOMEM;





	if (!mdev)

	if (!mdev)

		goto err_out_of_memory;

		return -ENOMEM;





	usb_set_intfdata(interface, mdev);

	usb_set_intfdata(interface, mdev);

	num_endpoints = usb_iface_desc->desc.bNumEndpoints;

	num_endpoints = usb_iface_desc->desc.bNumEndpoints;

	if (num_endpoints > MAX_NUM_ENDPOINTS) {

		kfree(mdev);

		return -EINVAL;

	}

	mutex_init(&mdev->io_mutex);

	mutex_init(&mdev->io_mutex);

	INIT_WORK(&mdev->poll_work_obj, wq_netinfo);

	INIT_WORK(&mdev->poll_work_obj, wq_netinfo);

	timer_setup(&mdev->link_stat_timer, link_stat_timer_handler, 0);

	timer_setup(&mdev->link_stat_timer, link_stat_timer_handler, 0);
@@ -1085,11 +1089,6 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id) 
	kfree(mdev->conf);

	kfree(mdev->conf);

err_free_mdev:

err_free_mdev:

	put_device(&mdev->dev);

	put_device(&mdev->dev);

err_out_of_memory:

	if (ret == 0 || ret == -ENOMEM) {

		ret = -ENOMEM;

		dev_err(dev, "out of memory\n");

	}

	return ret;

	return ret;

}

}