|
 |
e1aff3f |
Subject: [PATCH] Input: gtco: fix crash on detecting device without endpoints
|
|
|
e1aff3f |
From: Vladis Dronov <vdronov@redhat.com>
|
|
|
e1aff3f |
Date: 2016-03-18 18:35:00
|
|
|
e1aff3f |
|
|
|
e1aff3f |
The gtco driver expects at least one valid endpoint. If given
|
|
|
e1aff3f |
malicious descriptors that specify 0 for the number of endpoints,
|
|
|
e1aff3f |
it will crash in the probe function. Ensure there is at least
|
|
|
e1aff3f |
one endpoint on the interface before using it. Fix minor coding
|
|
|
e1aff3f |
style issue.
|
|
|
e1aff3f |
|
|
|
e1aff3f |
The full report of this issue can be found here:
|
|
|
e1aff3f |
http://seclists.org/bugtraq/2016/Mar/86
|
|
|
e1aff3f |
|
|
|
e1aff3f |
Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
|
|
|
e1aff3f |
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
|
|
|
e1aff3f |
---
|
|
|
e1aff3f |
drivers/input/tablet/gtco.c | 10 +++++++++-
|
|
|
e1aff3f |
1 file changed, 9 insertions(+), 1 deletion(-)
|
|
|
e1aff3f |
|
|
|
e1aff3f |
diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
|
|
|
e1aff3f |
index 3a7f3a4..7c18249 100644
|
|
|
e1aff3f |
--- a/drivers/input/tablet/gtco.c
|
|
|
e1aff3f |
+++ b/drivers/input/tablet/gtco.c
|
|
|
e1aff3f |
@@ -858,6 +858,14 @@ static int gtco_probe(struct usb_interface *usbinterface,
|
|
|
e1aff3f |
goto err_free_buf;
|
|
|
e1aff3f |
}
|
|
|
e1aff3f |
|
|
|
e1aff3f |
+ /* Sanity check that a device has an endpoint */
|
|
|
e1aff3f |
+ if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) {
|
|
|
e1aff3f |
+ dev_err(&usbinterface->dev,
|
|
|
e1aff3f |
+ "Invalid number of endpoints\n");
|
|
|
e1aff3f |
+ error = -EINVAL;
|
|
|
e1aff3f |
+ goto err_free_urb;
|
|
|
e1aff3f |
+ }
|
|
|
e1aff3f |
+
|
|
|
e1aff3f |
/*
|
|
|
e1aff3f |
* The endpoint is always altsetting 0, we know this since we know
|
|
|
e1aff3f |
* this device only has one interrupt endpoint
|
|
|
e1aff3f |
@@ -879,7 +887,7 @@ static int gtco_probe(struct usb_interface *usbinterface,
|
|
|
e1aff3f |
* HID report descriptor
|
|
|
e1aff3f |
*/
|
|
|
e1aff3f |
if (usb_get_extra_descriptor(usbinterface->cur_altsetting,
|
|
|
e1aff3f |
- HID_DEVICE_TYPE, &hid_desc) != 0){
|
|
|
e1aff3f |
+ HID_DEVICE_TYPE, &hid_desc) != 0) {
|
|
|
e1aff3f |
dev_err(&usbinterface->dev,
|
|
|
e1aff3f |
"Can't retrieve exta USB descriptor to get hid report descriptor length\n");
|
|
|
e1aff3f |
error = -EIO;
|
|
|
e1aff3f |
--
|
|
|
e1aff3f |
2.5.0
|