| From: Johan Hovold <johan@kernel.org> |
| Date: Fri, 10 Jan 2020 12:00:18 -0800 |
| Subject: Input: gtco - fix endpoint sanity check |
| |
| commit a8eeb74df5a6bdb214b2b581b14782c5f5a0cf83 upstream. |
| |
| The driver was checking the number of endpoints of the first alternate |
| setting instead of the current one, something which could lead to the |
| driver binding to an invalid interface. |
| |
| This in turn could cause the driver to misbehave or trigger a WARN() in |
| usb_submit_urb() that kernels with panic_on_warn set would choke on. |
| |
| Fixes: 162f98dea487 ("Input: gtco - fix crash on detecting device without endpoints") |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Acked-by: Vladis Dronov <vdronov@redhat.com> |
| Link: https://lore.kernel.org/r/20191210113737.4016-5-johan@kernel.org |
| Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/input/tablet/gtco.c | 10 +++------- |
| 1 file changed, 3 insertions(+), 7 deletions(-) |
| |
| --- a/drivers/input/tablet/gtco.c |
| +++ b/drivers/input/tablet/gtco.c |
| @@ -886,18 +886,14 @@ static int gtco_probe(struct usb_interfa |
| } |
| |
| /* Sanity check that a device has an endpoint */ |
| - if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) { |
| + if (usbinterface->cur_altsetting->desc.bNumEndpoints < 1) { |
| dev_err(&usbinterface->dev, |
| "Invalid number of endpoints\n"); |
| error = -EINVAL; |
| goto err_free_urb; |
| } |
| |
| - /* |
| - * The endpoint is always altsetting 0, we know this since we know |
| - * this device only has one interrupt endpoint |
| - */ |
| - endpoint = &usbinterface->altsetting[0].endpoint[0].desc; |
| + endpoint = &usbinterface->cur_altsetting->endpoint[0].desc; |
| |
| /* Some debug */ |
| dev_dbg(&usbinterface->dev, "gtco # interfaces: %d\n", usbinterface->num_altsetting); |
| @@ -984,7 +980,7 @@ static int gtco_probe(struct usb_interfa |
| input_dev->dev.parent = &usbinterface->dev; |
| |
| /* Setup the URB, it will be posted later on open of input device */ |
| - endpoint = &usbinterface->altsetting[0].endpoint[0].desc; |
| + endpoint = &usbinterface->cur_altsetting->endpoint[0].desc; |
| |
| usb_fill_int_urb(gtco->urbinfo, |
| gtco->usbdev, |
