Skip to content

Commit

Permalink
Input: gtco - fix crash on detecting device without endpoints
Browse files Browse the repository at this point in the history
The gtco driver expects at least one valid endpoint. If given malicious
descriptors that specify 0 for the number of endpoints, it will crash in
the probe function. Ensure there is at least one endpoint on the interface
before using it.

Also let's fix a minor coding style issue.

The full correct report of this issue can be found in the public
Red Hat Bugzilla:

https://bugzilla.redhat.com/show_bug.cgi?id=1283385

Change-Id: Ie90df605d0412aa31fa57047edc0dd59bc3f136b
Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
  • Loading branch information
nefigtut authored and Flex1911 committed Jul 9, 2017
1 parent 044c0da commit 39034b2
Showing 1 changed file with 9 additions and 1 deletion.
10 changes: 9 additions & 1 deletion drivers/input/tablet/gtco.c
Expand Up @@ -866,6 +866,14 @@ static int gtco_probe(struct usb_interface *usbinterface,
goto err_free_buf;
}

/* Sanity check that a device has an endpoint */
if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) {
dev_err(&usbinterface->dev,
"Invalid number of endpoints\n");
error = -EINVAL;
goto err_free_urb;
}

/*
* The endpoint is always altsetting 0, we know this since we know
* this device only has one interrupt endpoint
Expand All @@ -887,7 +895,7 @@ static int gtco_probe(struct usb_interface *usbinterface,
* HID report descriptor
*/
if (usb_get_extra_descriptor(usbinterface->cur_altsetting,
HID_DEVICE_TYPE, &hid_desc) != 0){
HID_DEVICE_TYPE, &hid_desc) != 0) {
err("Can't retrieve exta USB descriptor to get hid report descriptor length");
error = -EIO;
goto err_free_urb;
Expand Down

0 comments on commit 39034b2

Please sign in to comment.