Merge remote-tracking branch 'tip/timers/core' into afs-next

[mirror_ubuntu-focal-kernel.git] / drivers / usb / misc / usbtest.c

diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index b1ad69edf8395fe6106280cf6fe9c91d2e6225e3..5ad74750e8a4b858d77b98c9962f91dcccca78f8 100644 (file)
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -202,12 +202,13 @@ found:
                        return tmp;
        }
 
-       if (in) {
+       if (in)
                dev->in_pipe = usb_rcvbulkpipe(udev,
                        in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+       if (out)
                dev->out_pipe = usb_sndbulkpipe(udev,
                        out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
-       }
+
        if (iso_in) {
                dev->iso_in = &iso_in->desc;
                dev->in_iso_pipe = usb_rcvisocpipe(udev,
@@ -1972,6 +1973,9 @@ test_queue(struct usbtest_dev *dev, struct usbtest_param_32 *param,
        int                     status = 0;
        struct urb              *urbs[param->sglen];
 
+       if (!param->sglen || param->iterations > UINT_MAX / param->sglen)
+               return -EINVAL;
+
        memset(&context, 0, sizeof(context));
        context.count = param->iterations * param->sglen;
        context.dev = dev;
@@ -2095,6 +2099,8 @@ usbtest_do_ioctl(struct usb_interface *intf, struct usbtest_param_32 *param)
 
        if (param->iterations <= 0)
                return -EINVAL;
+       if (param->sglen > MAX_SGLEN)
+               return -EINVAL;
        /*
         * Just a bunch of test cases that every HCD is expected to handle.
         *