iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

staging: most: usb: check number of reported endpoints

Browse Source 
This patch checks the number of endpoints reported by the USB
interface descriptor and throws an error if the number exceeds
MAX_NUM_ENDPOINTS.

Signed-off-by: Christian Gromm <christian.gromm@microchip.com>
Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/1589534465-7423-4-git-send-email-christian.gromm@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Christian Gromm 2020-05-15 11:21:01 +02:00 committed by Greg Kroah-Hartman
parent bffea154b2
commit c1a57be08e
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/staging/most/usb/usb.c
View File

@ -950,13 +950,17 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id)
unsigned int num_endpoints;
struct most_channel_capability *tmp_cap;
struct usb_endpoint_descriptor *ep_desc;
int ret = 0;
int ret = -ENOMEM;
if (!mdev)
goto err_out_of_memory;
return -ENOMEM;
usb_set_intfdata(interface, mdev);
num_endpoints = usb_iface_desc->desc.bNumEndpoints;
if (num_endpoints > MAX_NUM_ENDPOINTS) {
kfree(mdev);
return -EINVAL;
}
mutex_init(&mdev->io_mutex);
INIT_WORK(&mdev->poll_work_obj, wq_netinfo);
timer_setup(&mdev->link_stat_timer, link_stat_timer_handler, 0);
@ -1085,11 +1089,6 @@ err_free_conf:
kfree(mdev->conf);
err_free_mdev:
put_device(&mdev->dev);
err_out_of_memory:
if (ret == 0 || ret == -ENOMEM) {
ret = -ENOMEM;
dev_err(dev, "out of memory\n");
}
return ret;
}