diff options
| author | Oliver Neukum <oneukum@suse.com> | 2020-09-16 16:50:51 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-10-29 11:05:41 +0300 |
| commit | 40dbafa3d5f11066504102cc314b2d21890455f4 (patch) | |
| tree | e2bb36f7a4c08d87d904d2a717002aad30ab459b | |
| parent | 13713d69e951824fc4882d75a1e791c78e9a3f2b (diff) | |
| download | linux-40dbafa3d5f11066504102cc314b2d21890455f4.tar.xz | |
media: ati_remote: sanity check for both endpoints
[ Upstream commit a8be80053ea74bd9c3f9a3810e93b802236d6498 ]
If you do sanity checks, you should do them for both endpoints.
Hence introduce checking for endpoint type for the output
endpoint, too.
Reported-by: syzbot+998261c2ae5932458f6c@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/media/rc/ati_remote.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/media/rc/ati_remote.c b/drivers/media/rc/ati_remote.c index 9f5b59706741..7f98db4bc027 100644 --- a/drivers/media/rc/ati_remote.c +++ b/drivers/media/rc/ati_remote.c @@ -850,6 +850,10 @@ static int ati_remote_probe(struct usb_interface *interface, err("%s: endpoint_in message size==0? \n", __func__); return -ENODEV; } + if (!usb_endpoint_is_int_out(endpoint_out)) { + err("%s: Unexpected endpoint_out\n", __func__); + return -ENODEV; + } ati_remote = kzalloc(sizeof (struct ati_remote), GFP_KERNEL); rc_dev = rc_allocate_device(); |