On Thu, Jul 25, 2019 at 11:51:58AM +0200, Oliver Neukum wrote: > The driver should check whether the endpoint it uses has the correct > type. > > Reported-by: syzbot+c7df50363aaff50aa363@xxxxxxxxxxxxxxxxxxxxxxxxx > Signed-off-by: Oliver Neukum <oneukum@xxxxxxxx> Applied, thank you. > --- > drivers/input/tablet/kbtab.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c > index 04b85571f41e..6f3b59ea2cd4 100644 > --- a/drivers/input/tablet/kbtab.c > +++ b/drivers/input/tablet/kbtab.c > @@ -116,6 +116,9 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i > > if (intf->cur_altsetting->desc.bNumEndpoints < 1) > return -ENODEV; > + endpoint = &intf->cur_altsetting->endpoint[0].desc; > + if (!usb_endpoint_is_int_in(endpoint)) > + return -ENODEV; > > kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL); > input_dev = input_allocate_device(); > @@ -155,8 +158,6 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i > input_set_abs_params(input_dev, ABS_Y, 0, 0x1750, 4, 0); > input_set_abs_params(input_dev, ABS_PRESSURE, 0, 0xff, 0, 0); > > - endpoint = &intf->cur_altsetting->endpoint[0].desc; > - > usb_fill_int_urb(kbtab->irq, dev, > usb_rcvintpipe(dev, endpoint->bEndpointAddress), > kbtab->data, 8, > -- > 2.16.4 > -- Dmitry
