Am Montag, den 05.08.2019, 04:58 -0700 schrieb syzbot: > Hello, > > syzbot found the following crash on: > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver > git tree: https://github.com/google/kasan.git usb-fuzzer > console output: https://syzkaller.appspot.com/x/log.txt?x=10809e0c600000 > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e > dashboard link: https://syzkaller.appspot.com/bug?extid=5efc10c005014d061a74 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15e40b1a600000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=174a69d8600000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+5efc10c005014d061...@syzkaller.appspotmail.com
#syz test: https://github.com/google/kasan.git e96407b4 >From 06be579ae09483c7c723067f4e5bf938ad302bda Mon Sep 17 00:00:00 2001 From: Oliver Neukum <oneu...@suse.com> Date: Tue, 6 Aug 2019 15:33:35 +0200 Subject: [PATCH] iforce: add sanity checks The endpoint type should also be checked before a device is accepted. Reported-by: syzbot+5efc10c005014d061...@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum <oneu...@suse.com> --- drivers/input/joystick/iforce/iforce-usb.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c index 29abfeeef9a5..a481a226166c 100644 --- a/drivers/input/joystick/iforce/iforce-usb.c +++ b/drivers/input/joystick/iforce/iforce-usb.c @@ -203,6 +203,11 @@ static int iforce_usb_probe(struct usb_interface *intf, epirq = &interface->endpoint[0].desc; epout = &interface->endpoint[1].desc; + if (!usb_endpoint_is_int_in(epirq)) + return -ENODEV; + if (!usb_endpoint_is_int_out(epout)) + return -ENODEV; + iforce_usb = kzalloc(sizeof(*iforce_usb), GFP_KERNEL); if (!iforce_usb) goto fail; -- 2.16.4
