diff options
| author | Christian Gromm <christian.gromm@microchip.com> | 2020-05-15 11:21:01 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-05-15 15:35:12 +0200 |
| commit | c1a57be08e734baf1b89e4a5027cf78c68f29771 (patch) | |
| tree | 9d861be1fd4e9e07c15519f141a4e35f67aba730 /drivers/staging/most/usb | |
| parent | bffea154b24bd71851f883acb08399e43d598d01 (diff) | |
staging: most: usb: check number of reported endpoints
This patch checks the number of endpoints reported by the USB
interface descriptor and throws an error if the number exceeds
MAX_NUM_ENDPOINTS.
Signed-off-by: Christian Gromm <christian.gromm@microchip.com>
Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/1589534465-7423-4-git-send-email-christian.gromm@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/most/usb')
| -rw-r--r-- | drivers/staging/most/usb/usb.c | 13 |
1 files changed, 6 insertions, 7 deletions
diff --git a/drivers/staging/most/usb/usb.c b/drivers/staging/most/usb/usb.c index dbb6003a9e0b..36c277f2bbb0 100644 --- a/drivers/staging/most/usb/usb.c +++ b/drivers/staging/most/usb/usb.c @@ -950,13 +950,17 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id) unsigned int num_endpoints; struct most_channel_capability *tmp_cap; struct usb_endpoint_descriptor *ep_desc; - int ret = 0; + int ret = -ENOMEM; if (!mdev) - goto err_out_of_memory; + return -ENOMEM; usb_set_intfdata(interface, mdev); num_endpoints = usb_iface_desc->desc.bNumEndpoints; + if (num_endpoints > MAX_NUM_ENDPOINTS) { + kfree(mdev); + return -EINVAL; + } mutex_init(&mdev->io_mutex); INIT_WORK(&mdev->poll_work_obj, wq_netinfo); timer_setup(&mdev->link_stat_timer, link_stat_timer_handler, 0); @@ -1085,11 +1089,6 @@ err_free_conf: kfree(mdev->conf); err_free_mdev: put_device(&mdev->dev); -err_out_of_memory: - if (ret == 0 || ret == -ENOMEM) { - ret = -ENOMEM; - dev_err(dev, "out of memory\n"); - } return ret; } |