iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[media] usbvision: fix crash on detecting device with invalid configuration

Browse Source 
The usbvision driver crashes when a specially crafted usb device with invalid
number of interfaces or endpoints is detected. This fix adds checks that the
device has proper configuration expected by the driver.

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
This commit is contained in:
Vladis Dronov 2015-11-16 15:55:11 -02:00 committed by Mauro Carvalho Chehab
parent 1efc21701d
commit fa52bd506f
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/media/usb/usbvision/usbvision-video.c
View File

@ -1470,9 +1470,23 @@ static int usbvision_probe(struct usb_interface *intf,
if (usbvision_device_data[model].interface >= 0)
interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0];
else
else if (ifnum < dev->actconfig->desc.bNumInterfaces)
interface = &dev->actconfig->interface[ifnum]->altsetting[0];
else {
dev_err(&intf->dev, "interface %d is invalid, max is %d\n",
ifnum, dev->actconfig->desc.bNumInterfaces - 1);
ret = -ENODEV;
goto err_usb;
}
if (interface->desc.bNumEndpoints < 2) {
dev_err(&intf->dev, "interface %d has %d endpoints, but must"
" have minimum 2\n", ifnum, interface->desc.bNumEndpoints);
ret = -ENODEV;
goto err_usb;
}
endpoint = &interface->endpoint[1].desc;
if (!usb_endpoint_xfer_isoc(endpoint)) {
dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n",
__func__, ifnum);