Input: kbtab - sanity check for endpoint type

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

The driver should check whether the endpoint it uses has the correct
type.

Reported-by: syzbot+c7df50363aaff50aa363@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

authored by

Oliver Neukum and committed by

Dmitry Torokhov 6 years ago c88090df b55d996f

+4 -2

1 changed file

expand all

drivers

input

tablet

kbtab.c

+4 -2

drivers/input/tablet/kbtab.c

··· 117 117 if (intf->cur_altsetting->desc.bNumEndpoints < 1) 118 118 return -ENODEV; 119 119 120 + endpoint = &intf->cur_altsetting->endpoint[0].desc; 121 + if (!usb_endpoint_is_int_in(endpoint)) 122 + return -ENODEV; 123 + 120 124 kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL); 121 125 input_dev = input_allocate_device(); 122 126 if (!kbtab || !input_dev) ··· 158 154 input_set_abs_params(input_dev, ABS_X, 0, 0x2000, 4, 0); 159 155 input_set_abs_params(input_dev, ABS_Y, 0, 0x1750, 4, 0); 160 156 input_set_abs_params(input_dev, ABS_PRESSURE, 0, 0xff, 0, 0); 161 - 162 - endpoint = &intf->cur_altsetting->endpoint[0].desc; 163 157 164 158 usb_fill_int_urb(kbtab->irq, dev, 165 159 usb_rcvintpipe(dev, endpoint->bEndpointAddress),