[PATCH net] net: usb: catc: enable basic endpoint checking

[PATCH net] net: usb: catc: enable basic endpoint checking

[Ziyi Guo]

catc_probe() fills three URBs with hardcoded endpoint pipes without
verifying the endpoint descriptors:

  - usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX
  - usb_rcvintpipe(usbdev, 2) for interrupt status

A malformed USB device can present these endpoints with transfer types
that differ from what the driver assumes.

Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls
after usb_set_interface() to verify endpoint types before use, rejecting
devices with mismatched descriptors at probe time.

Similar to
- commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking")
which fixed the issue in rtl8150.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
---
 drivers/net/usb/catc.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/net/usb/catc.c b/drivers/net/usb/catc.c
index 6759388692f8..e92773cbf5f9 100644
--- a/drivers/net/usb/catc.c
+++ b/drivers/net/usb/catc.c
@@ -770,6 +770,13 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
 	struct net_device *netdev;
 	struct catc *catc;
 	u8 broadcast[ETH_ALEN];
+	static const u8 bulk_ep_addr[] = {
+		USB_DIR_OUT | 1,	/* EP 1 OUT (TX) */
+		USB_DIR_IN | 1,		/* EP 1 IN  (RX) */
+		0};
+	static const u8 int_ep_addr[] = {
+		USB_DIR_IN | 2,		/* EP 2 IN  (interrupt) */
+		0};
 	u8 *macbuf;
 	int pktsz, ret = -ENOMEM;
 
@@ -784,6 +791,14 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
 		goto fail_mem;
 	}
 
+	/* Verify that all required endpoints are present */
+	if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) ||
+	    !usb_check_int_endpoints(intf, int_ep_addr)) {
+		dev_err(dev, "Missing or invalid endpoints\n");
+		ret = -ENODEV;
+		goto fail_mem;
+	}
+
 	netdev = alloc_etherdev(sizeof(struct catc));
 	if (!netdev)
 		goto fail_mem;
-- 
2.34.1

Re: [PATCH net] net: usb: catc: enable basic endpoint checking

[Simon Horman]

On Tue, Feb 10, 2026 at 02:43:41AM +0000, Ziyi Guo wrote:
> catc_probe() fills three URBs with hardcoded endpoint pipes without
> verifying the endpoint descriptors:
> 
>   - usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX
>   - usb_rcvintpipe(usbdev, 2) for interrupt status
> 
> A malformed USB device can present these endpoints with transfer types
> that differ from what the driver assumes.
> 
> Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls
> after usb_set_interface() to verify endpoint types before use, rejecting
> devices with mismatched descriptors at probe time.
> 
> Similar to
> - commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking")
> which fixed the issue in rtl8150.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
> ---
>  drivers/net/usb/catc.c | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
> 
> diff --git a/drivers/net/usb/catc.c b/drivers/net/usb/catc.c
> index 6759388692f8..e92773cbf5f9 100644
> --- a/drivers/net/usb/catc.c
> +++ b/drivers/net/usb/catc.c
> @@ -770,6 +770,13 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
>  	struct net_device *netdev;
>  	struct catc *catc;
>  	u8 broadcast[ETH_ALEN];
> +	static const u8 bulk_ep_addr[] = {
> +		USB_DIR_OUT | 1,	/* EP 1 OUT (TX) */
> +		USB_DIR_IN | 1,		/* EP 1 IN  (RX) */
> +		0};
> +	static const u8 int_ep_addr[] = {
> +		USB_DIR_IN | 2,		/* EP 2 IN  (interrupt) */

Hi,

I think that it would be good to use an enum instead of the magic
numbers 1 and 2, even if documented inline.

I'm suggesting something similar to what was done in the cited commit.

> +		0};
>  	u8 *macbuf;
>  	int pktsz, ret = -ENOMEM;
>  
> @@ -784,6 +791,14 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
>  		goto fail_mem;
>  	}
>  
> +	/* Verify that all required endpoints are present */
> +	if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) ||
> +	    !usb_check_int_endpoints(intf, int_ep_addr)) {
> +		dev_err(dev, "Missing or invalid endpoints\n");
> +		ret = -ENODEV;
> +		goto fail_mem;
> +	}
> +
>  	netdev = alloc_etherdev(sizeof(struct catc));
>  	if (!netdev)
>  		goto fail_mem;
> -- 
> 2.34.1
> 
> 

Re: [PATCH net] net: usb: catc: enable basic endpoint checking

[Ziyi Guo]

On Thu, Feb 12, 2026 at 11:09 AM Simon Horman <horms@kernel.org> wrote:
>
> I think that it would be good to use an enum instead of the magic
> numbers 1 and 2, even if documented inline.
>
> I'm suggesting something similar to what was done in the cited commit.

Hi Simon,

Thanks for your time and reply, sure, I'll revise and send a v2 version patch.