media: iguanair: add sanity checks

BugLink: https://bugs.launchpad.net/bugs/1848046
[ Upstream commit ab1cbdf159beba7395a13ab70bc71180929ca064 ]

The driver needs to check the endpoint types, too, as opposed
to the number of endpoints. This also requires moving the check earlier.

Reported-by: syzbot+01a77b82edaa374068e1@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c
index ea05e125016a741cf12bc63c1671131b802a2d5b..872d6441e512cda9bf940bcbf2dd5b6e8c9864a8 100644 (file)
--- a/drivers/media/rc/iguanair.c
+++ b/drivers/media/rc/iguanair.c
@@ -413,6 +413,10 @@ static int iguanair_probe(struct usb_interface *intf,
        int ret, pipein, pipeout;
        struct usb_host_interface *idesc;
 
+       idesc = intf->altsetting;
+       if (idesc->desc.bNumEndpoints < 2)
+               return -ENODEV;
+
        ir = kzalloc(sizeof(*ir), GFP_KERNEL);
        rc = rc_allocate_device(RC_DRIVER_IR_RAW);
        if (!ir || !rc) {
@@ -427,18 +431,13 @@ static int iguanair_probe(struct usb_interface *intf,
        ir->urb_in = usb_alloc_urb(0, GFP_KERNEL);
        ir->urb_out = usb_alloc_urb(0, GFP_KERNEL);
 
-       if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out) {
+       if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out ||
+           !usb_endpoint_is_int_in(&idesc->endpoint[0].desc) ||
+           !usb_endpoint_is_int_out(&idesc->endpoint[1].desc)) {
                ret = -ENOMEM;
                goto out;
        }
 
-       idesc = intf->altsetting;
-
-       if (idesc->desc.bNumEndpoints < 2) {
-               ret = -ENODEV;
-               goto out;
-       }
-
        ir->rc = rc;
        ir->dev = &intf->dev;
        ir->udev = udev;