* [PATCH] Input: Check sanity of pipe in pegasus_probe()
@ 2023-04-04 7:41 Soumya Negi
2023-04-10 2:24 ` Dmitry Torokhov
0 siblings, 1 reply; 2+ messages in thread
From: Soumya Negi @ 2023-04-04 7:41 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: Soumya Negi, linux-input, linux-kernel
Fix WARNING in pegasus_open/usb_submit_urb
Syzbot bug: https://syzkaller.appspot.com/bug?id=bbc107584dcf3262253ce93183e51f3612aaeb13
Warning raised because pegasus_driver submits transfer request for
bogus URB(pipe type does not match endpoint type). Add sanity check at
probe time for pipe value extracted from endpoint descriptor. Probe
will fail if sanity check fails.
Reported-and-tested-by: syzbot+04ee0cb4caccaed12d78@syzkaller.appspotmail.com
Signed-off-by: Soumya Negi <soumya.negi97@gmail.com>
---
drivers/input/tablet/pegasus_notetaker.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/input/tablet/pegasus_notetaker.c b/drivers/input/tablet/pegasus_notetaker.c
index d836d3dcc6a2..a68da2988f9c 100644
--- a/drivers/input/tablet/pegasus_notetaker.c
+++ b/drivers/input/tablet/pegasus_notetaker.c
@@ -296,6 +296,12 @@ static int pegasus_probe(struct usb_interface *intf,
pegasus->intf = intf;
pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
+ /* Sanity check that pipe's type matches endpoint's type */
+ if (usb_pipe_type_check(dev, pipe)) {
+ error = -EINVAL;
+ goto err_free_mem;
+ }
+
pegasus->data_len = usb_maxpacket(dev, pipe);
pegasus->data = usb_alloc_coherent(dev, pegasus->data_len, GFP_KERNEL,
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Input: Check sanity of pipe in pegasus_probe()
2023-04-04 7:41 [PATCH] Input: Check sanity of pipe in pegasus_probe() Soumya Negi
@ 2023-04-10 2:24 ` Dmitry Torokhov
0 siblings, 0 replies; 2+ messages in thread
From: Dmitry Torokhov @ 2023-04-10 2:24 UTC (permalink / raw)
To: Soumya Negi; +Cc: linux-input, linux-kernel
On Tue, Apr 04, 2023 at 12:41:45AM -0700, Soumya Negi wrote:
> Fix WARNING in pegasus_open/usb_submit_urb
> Syzbot bug: https://syzkaller.appspot.com/bug?id=bbc107584dcf3262253ce93183e51f3612aaeb13
>
> Warning raised because pegasus_driver submits transfer request for
> bogus URB(pipe type does not match endpoint type). Add sanity check at
> probe time for pipe value extracted from endpoint descriptor. Probe
> will fail if sanity check fails.
>
> Reported-and-tested-by: syzbot+04ee0cb4caccaed12d78@syzkaller.appspotmail.com
> Signed-off-by: Soumya Negi <soumya.negi97@gmail.com>
Applied, thank you.
--
Dmitry
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-04-10 2:24 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-04-04 7:41 [PATCH] Input: Check sanity of pipe in pegasus_probe() Soumya Negi
2023-04-10 2:24 ` Dmitry Torokhov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).