Commit c58b6c29 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman Committed by Jakub Kicinski
Browse files

net: usb: kalmia: validate USB endpoints 



The kalmia driver should validate that the device it is probing has the
proper number and types of USB endpoints it is expecting before it binds
to it.  If a malicious device were to not have the same urbs the driver
will crash later on when it blindly accesses these endpoints.

Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Fixes: d4026123 ("net/usb: Add Samsung Kalmia driver for Samsung GT-B3730")
Link: https://patch.msgid.link/2026022326-shack-headstone-ef6f@gregkh


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 11de1d3a

drivers/net/usb/kalmia.c

+7 −0
Original line number Diff line number Diff line
@@ -132,11 +132,18 @@ kalmia_bind(struct usbnet *dev, struct usb_interface *intf) 
{

	int status;

	u8 ethernet_addr[ETH_ALEN];

	static const u8 ep_addr[] = {

		1 | USB_DIR_IN,

		2 | USB_DIR_OUT,

		0};



	/* Don't bind to AT command interface */

	if (intf->cur_altsetting->desc.bInterfaceClass != USB_CLASS_VENDOR_SPEC)

		return -EINVAL;



	if (!usb_check_bulk_endpoints(intf, ep_addr))

		return -ENODEV;



	dev->in = usb_rcvbulkpipe(dev->udev, 0x81 & USB_ENDPOINT_NUMBER_MASK);

	dev->out = usb_sndbulkpipe(dev->udev, 0x02 & USB_ENDPOINT_NUMBER_MASK);

	dev->status = NULL;