github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-25 23:52:08 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/udl: Handle errors from usb_get_descriptor()

Browse Source 
Reading the vendor descriptor from the udl device can fail with
an error, which the current code fails to capture. Store the return
value in an integer and test for the error. Abort parsing on errors
or treat the value as length on success.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://lore.kernel.org/r/20250410105948.25463-6-tzimmermann@suse.de
This commit is contained in:
Thomas Zimmermann 2025-04-10 12:59:02 +02:00
parent 89323678d8
commit 895452ae48
1 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
drivers/gpu/drm/udl/udl_main.c
View File

@ -31,28 +31,32 @@ static int udl_parse_vendor_descriptor(struct udl_device *udl)
char *desc;
char *buf;
char *desc_end;
u8 total_len = 0;
int ret;
unsigned int len;
buf = kzalloc(MAX_VENDOR_DESCRIPTOR_SIZE, GFP_KERNEL);
if (!buf)
return false;
desc = buf;
total_len = usb_get_descriptor(udev, 0x5f, /* vendor specific */
0, desc, MAX_VENDOR_DESCRIPTOR_SIZE);
if (total_len > 5) {
DRM_INFO("vendor descriptor length:%x data:%11ph\n",
total_len, desc);
ret = usb_get_descriptor(udev, 0x5f, /* vendor specific */
0, desc, MAX_VENDOR_DESCRIPTOR_SIZE);
if (ret < 0)
goto unrecognized;
len = ret;
if ((desc[0] != total_len) || /* descriptor length */
if (len > 5) {
DRM_INFO("vendor descriptor length: %u data:%11ph\n",
len, desc);
if ((desc[0] != len) || /* descriptor length */
(desc[1] != 0x5f) || /* vendor descriptor type */
(desc[2] != 0x01) || /* version (2 bytes) */
(desc[3] != 0x00) ||
(desc[4] != total_len - 2)) /* length after type */
(desc[4] != len - 2)) /* length after type */
goto unrecognized;
desc_end = desc + total_len;
desc_end = desc + len;
desc += 5; /* the fixed header we've already parsed */
while (desc < desc_end) {