From 1c3b3f58608e2c75e0264a1b7eae21245d446d78 Mon Sep 17 00:00:00 2001 From: Oliver Neukum Date: Wed, 22 Apr 2020 13:49:55 +0200 Subject: [PATCH] go7007: add sanity checking and insanity checking A malicious USB device may lack endpoints the driver assumes to exist Accessing them leads to NULL pointer accesses. This patch introduces sanity checking. Signed-off-by: Oliver Neukum Fixes: 866b8695d67e8 ("Staging: add the go7007 video driver") --- drivers/media/usb/go7007/go7007-usb.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c index f889c9d740cd..43b2f018df54 100644 --- a/drivers/media/usb/go7007/go7007-usb.c +++ b/drivers/media/usb/go7007/go7007-usb.c @@ -1050,6 +1050,10 @@ static int go7007_usb_probe(struct usb_interface *intf, int video_pipe, i, v_urb_len; pr_debug("probing new GO7007 USB board\n"); + if (!intf) + printk(KERN_ERR"Dave, will I dream?\n"); + if (!usbdev) + printk(KERN_ERR"Shai Hulud!\n"); switch (id->driver_info) { case GO7007_BOARDID_MATRIX_II: @@ -1121,6 +1125,14 @@ static int go7007_usb_probe(struct usb_interface *intf, return -ENOMEM; } + /* sanity checks */ + if (usb && usb->usbdev) + ep = usb->usbdev->ep_in[4]; + else + ep = NULL; + if (!ep) + return -ENODEV; + usb->board = board; usb->usbdev = usbdev; usb_make_path(usbdev, go->bus_info, sizeof(go->bus_info)); @@ -1141,7 +1153,6 @@ static int go7007_usb_probe(struct usb_interface *intf, if (usb->intr_urb->transfer_buffer == NULL) goto allocfail; - ep = usb->usbdev->ep_in[4]; if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK) usb_fill_bulk_urb(usb->intr_urb, usb->usbdev, usb_rcvbulkpipe(usb->usbdev, 4), @@ -1263,9 +1274,13 @@ static int go7007_usb_probe(struct usb_interface *intf, /* Allocate the URBs and buffers for receiving the video stream */ if (board->flags & GO7007_USB_EZUSB) { + if (!usb->usbdev->ep_in[6]) + goto allocfail; v_urb_len = 1024; video_pipe = usb_rcvbulkpipe(usb->usbdev, 6); } else { + if (!usb->usbdev->ep_in[1]) + goto allocfail; v_urb_len = 512; video_pipe = usb_rcvbulkpipe(usb->usbdev, 1); } @@ -1285,6 +1300,8 @@ static int go7007_usb_probe(struct usb_interface *intf, /* Allocate the URBs and buffers for receiving the audio stream */ if ((board->flags & GO7007_USB_EZUSB) && (board->main_info.flags & GO7007_BOARD_HAS_AUDIO)) { + if (!usb->usbdev->ep_in[8]) + goto allocfail; for (i = 0; i < 8; ++i) { usb->audio_urbs[i] = usb_alloc_urb(0, GFP_KERNEL); if (usb->audio_urbs[i] == NULL) -- 2.16.4