Skip to content

Commit

Permalink
umcs(4): Reject invalid interrupt endpoints.
Browse files Browse the repository at this point in the history 
Reported-by: syzbot+cd1e60e112e840e40d0a@syzkaller.appspotmail.com
  • Loading branch information
riastradh authored and riastradh committed Jun 26, 2022
1 parent 4b8fdc3 commit 2b1f9e5
Showing 1 changed file with 8 additions and 2 deletions.
10 changes: 8 additions & 2 deletions sys/dev/usb/umcs.c
View file
@@ -1,4 +1,4 @@
/* $NetBSD: umcs.c,v 1.19 2022/04/19 01:35:28 riastradh Exp $ */
/* $NetBSD: umcs.c,v 1.20 2022/06/26 21:35:53 riastradh Exp $ */
/* $FreeBSD: head/sys/dev/usb/serial/umcs.c 260559 2014-01-12 11:44:28Z hselasky $ */

/*-
Expand Down Expand Up @@ -41,7 +41,7 @@
*
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: umcs.c,v 1.19 2022/04/19 01:35:28 riastradh Exp $");
__KERNEL_RCSID(0, "$NetBSD: umcs.c,v 1.20 2022/06/26 21:35:53 riastradh Exp $");

#include <sys/param.h>
#include <sys/systm.h>
Expand Down Expand Up @@ -276,6 +276,12 @@ umcs7840_attach(device_t parent, device_t self, void *aux)
sc->sc_dying = true;
return;
}
if (sc->sc_intr_buflen == 0) {
aprint_error_dev(self, "invalid interrupt endpoint"
" (addr %d)\n", intr_addr);
sc->sc_dying = true;
return;
}
sc->sc_intr_buf = kmem_alloc(sc->sc_intr_buflen, KM_SLEEP);

error = usbd_open_pipe_intr(sc->sc_iface, intr_addr,
Expand Down

0 comments on commit 2b1f9e5

Please sign in to comment.