[PATCH] Input: Check sanity of endpoint in pegasus_open()
STALE1497d
From: Soumya Negi <hidden>
Date: 2022-08-29 12:52:25
Also in:
linux-kernel-mentees, lkml
Subsystem:
input (keyboard, mouse, joystick, touchscreen) drivers, the rest · Maintainers:
Dmitry Torokhov, Linus Torvalds
Fix WARNING in pegasus_open/usb_submit_urb Syzbot bug: https://syzkaller.appspot.com/bug?id=bbc107584dcf3262253ce93183e51f3612aaeb13 Add sanity check of endpoint for Pegasus URB in pegasus_open() so that transfer requests for bogus URBs are not submitted. If the URB is bogus pegasus_open() will fail. Reported-by: syzbot+04ee0cb4caccaed12d78@syzkaller.appspotmail.com Signed-off-by: Soumya Negi <redacted> --- drivers/input/tablet/pegasus_notetaker.c | 9 +++++++++ 1 file changed, 9 insertions(+)
diff --git a/drivers/input/tablet/pegasus_notetaker.c b/drivers/input/tablet/pegasus_notetaker.c
index c608ac505d1b..5e47882ee4c0 100644
--- a/drivers/input/tablet/pegasus_notetaker.c
+++ b/drivers/input/tablet/pegasus_notetaker.c@@ -225,6 +225,15 @@ static int pegasus_open(struct input_dev *dev) mutex_lock(&pegasus->pm_mutex); pegasus->irq->dev = pegasus->usbdev; + + /* Sanity check of endpoint in Pegasus URB */ + error = usb_urb_ep_type_check(pegasus->irq); + if (error) { + dev_err(&pegasus->usbdev->dev, + "URB failed endpoint sanity check: %d\n", error); + goto err_autopm_put; + } + if (usb_submit_urb(pegasus->irq, GFP_KERNEL)) { error = -EIO; goto err_autopm_put;
--
2.17.1