The endpoint type should also be checked before a device is accepted. Reported-by: syzbot+5efc10c005014d061a74@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Oliver Neukum <oneukum@xxxxxxxx> --- drivers/input/joystick/iforce/iforce-usb.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c index 29abfeeef9a5..a481a226166c 100644 --- a/drivers/input/joystick/iforce/iforce-usb.c +++ b/drivers/input/joystick/iforce/iforce-usb.c @@ -203,6 +203,11 @@ static int iforce_usb_probe(struct usb_interface *intf, epirq = &interface->endpoint[0].desc; epout = &interface->endpoint[1].desc; + if (!usb_endpoint_is_int_in(epirq)) + return -ENODEV; + if (!usb_endpoint_is_int_out(epout)) + return -ENODEV; + iforce_usb = kzalloc(sizeof(*iforce_usb), GFP_KERNEL); if (!iforce_usb) goto fail; -- 2.16.4
