Commit b3d80fd2 authored by Soumya Negi's avatar Soumya Negi Committed by Dmitry Torokhov

Input: pegasus-notetaker - check pipe type when probing

Fix WARNING in pegasus_open/usb_submit_urb
Syzbot bug: https://syzkaller.appspot.com/bug?id=bbc107584dcf3262253ce93183e51f3612aaeb13

Warning raised because pegasus_driver submits transfer request for
bogus URB (pipe type does not match endpoint type). Add sanity check at
probe time for pipe value extracted from endpoint descriptor. Probe
will fail if sanity check fails.

Reported-and-tested-by: syzbot+04ee0cb4caccaed12d78@syzkaller.appspotmail.com
Signed-off-by: default avatarSoumya Negi <soumya.negi97@gmail.com>
Link: https://lore.kernel.org/r/20230404074145.11523-1-soumya.negi97@gmail.comSigned-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
parent cbedf1a3
...@@ -296,6 +296,12 @@ static int pegasus_probe(struct usb_interface *intf, ...@@ -296,6 +296,12 @@ static int pegasus_probe(struct usb_interface *intf,
pegasus->intf = intf; pegasus->intf = intf;
pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress); pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
/* Sanity check that pipe's type matches endpoint's type */
if (usb_pipe_type_check(dev, pipe)) {
error = -EINVAL;
goto err_free_mem;
}
pegasus->data_len = usb_maxpacket(dev, pipe); pegasus->data_len = usb_maxpacket(dev, pipe);
pegasus->data = usb_alloc_coherent(dev, pegasus->data_len, GFP_KERNEL, pegasus->data = usb_alloc_coherent(dev, pegasus->data_len, GFP_KERNEL,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment