[PATCH net] net: usb: catc: enable basic endpoint checking
From: Ziyi Guo <hidden>
Date: 2026-02-10 02:43:44
Also in:
linux-usb, lkml
Subsystem:
networking drivers, the rest, usb networking drivers · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
catc_probe() fills three URBs with hardcoded endpoint pipes without
verifying the endpoint descriptors:
- usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX
- usb_rcvintpipe(usbdev, 2) for interrupt status
A malformed USB device can present these endpoints with transfer types
that differ from what the driver assumes.
Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls
after usb_set_interface() to verify endpoint types before use, rejecting
devices with mismatched descriptors at probe time.
Similar to
- commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking")
which fixed the issue in rtl8150.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ziyi Guo <redacted>
---
drivers/net/usb/catc.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/net/usb/catc.c b/drivers/net/usb/catc.c
index 6759388692f8..e92773cbf5f9 100644
--- a/drivers/net/usb/catc.c
+++ b/drivers/net/usb/catc.c@@ -770,6 +770,13 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id struct net_device *netdev; struct catc *catc; u8 broadcast[ETH_ALEN]; + static const u8 bulk_ep_addr[] = { + USB_DIR_OUT | 1, /* EP 1 OUT (TX) */ + USB_DIR_IN | 1, /* EP 1 IN (RX) */ + 0}; + static const u8 int_ep_addr[] = { + USB_DIR_IN | 2, /* EP 2 IN (interrupt) */ + 0}; u8 *macbuf; int pktsz, ret = -ENOMEM;
@@ -784,6 +791,14 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id goto fail_mem; } + /* Verify that all required endpoints are present */ + if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) || + !usb_check_int_endpoints(intf, int_ep_addr)) { + dev_err(dev, "Missing or invalid endpoints\n"); + ret = -ENODEV; + goto fail_mem; + } + netdev = alloc_etherdev(sizeof(struct catc)); if (!netdev) goto fail_mem;
--
2.34.1