summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorJohan Hovold <johan@kernel.org>2017-03-16 11:41:55 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-03-30 09:35:15 +0200
commitb3c4c0c470b58dd4a5e40e11ccd9fea7fbbfa799 (patch)
tree631255c6fdaa671b8e2fb71fb541a4bdb81d0f39 /drivers
parentc05490638ddfffa35d2fb03c1852f9013757a9e1 (diff)
Input: kbtab - validate number of endpoints before using them
commit cb1b494663e037253337623bf1ef2df727883cb7 upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints. Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/input/tablet/kbtab.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c
index d2ac7c2b5b82..2812f9236b7d 100644
--- a/drivers/input/tablet/kbtab.c
+++ b/drivers/input/tablet/kbtab.c
@@ -122,6 +122,9 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
struct input_dev *input_dev;
int error = -ENOMEM;
+ if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+ return -ENODEV;
+
kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL);
input_dev = input_allocate_device();
if (!kbtab || !input_dev)