summaryrefslogtreecommitdiff
path: root/drivers/media
diff options
context:
space:
mode:
authorOliver Neukum <oneukum@suse.com>2020-09-16 15:50:51 +0200
committerMauro Carvalho Chehab <mchehab+huawei@kernel.org>2020-09-27 11:24:07 +0200
commita8be80053ea74bd9c3f9a3810e93b802236d6498 (patch)
tree38a21f2fa68c209007395f7439d5a9c91430bc7a /drivers/media
parentce5d72b6f5a0b694b19cd812788d8e1ea49aea21 (diff)
media: ati_remote: sanity check for both endpoints
If you do sanity checks, you should do them for both endpoints. Hence introduce checking for endpoint type for the output endpoint, too. Reported-by: syzbot+998261c2ae5932458f6c@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Diffstat (limited to 'drivers/media')
-rw-r--r--drivers/media/rc/ati_remote.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/media/rc/ati_remote.c b/drivers/media/rc/ati_remote.c
index 9cdef17b4793..c12dda73cdd5 100644
--- a/drivers/media/rc/ati_remote.c
+++ b/drivers/media/rc/ati_remote.c
@@ -835,6 +835,10 @@ static int ati_remote_probe(struct usb_interface *interface,
err("%s: endpoint_in message size==0? \n", __func__);
return -ENODEV;
}
+ if (!usb_endpoint_is_int_out(endpoint_out)) {
+ err("%s: Unexpected endpoint_out\n", __func__);
+ return -ENODEV;
+ }
ati_remote = kzalloc(sizeof (struct ati_remote), GFP_KERNEL);
rc_dev = rc_allocate_device(RC_DRIVER_SCANCODE);