Unverified Commit 97e5e2c5 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!7034 fix CVE-2024-27001 for 4.19 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wupeng Ma <mawupeng1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/5XCGMJRG6FG6YLR4JZ5ELJCCP5TU4LZN/ 
From: Ma Wupeng <mawupeng1@huawei.com>

fix CVE-2024-27001 for 4.19.

Nikita Zhandarovich (1):
  comedi: vmk80xx: fix incomplete endpoint checking


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/I9L5A8 
 
Link:https://gitee.com/openeuler/kernel/pulls/7034

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 96ef4402 1df55a0c

drivers/staging/comedi/drivers/vmk80xx.c

+12 −23
Original line number Diff line number Diff line
@@ -640,33 +640,22 @@ static int vmk80xx_find_usb_endpoints(struct comedi_device *dev) 
	struct vmk80xx_private *devpriv = dev->private;

	struct usb_interface *intf = comedi_to_usb_interface(dev);

	struct usb_host_interface *iface_desc = intf->cur_altsetting;

	struct usb_endpoint_descriptor *ep_desc;

	int i;



	if (iface_desc->desc.bNumEndpoints != 2)

		return -ENODEV;



	for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {

		ep_desc = &iface_desc->endpoint[i].desc;



		if (usb_endpoint_is_int_in(ep_desc) ||

		    usb_endpoint_is_bulk_in(ep_desc)) {

			if (!devpriv->ep_rx)

				devpriv->ep_rx = ep_desc;

			continue;

		}

	struct usb_endpoint_descriptor *ep_rx_desc, *ep_tx_desc;

	int ret;



		if (usb_endpoint_is_int_out(ep_desc) ||

		    usb_endpoint_is_bulk_out(ep_desc)) {

			if (!devpriv->ep_tx)

				devpriv->ep_tx = ep_desc;

			continue;

		}

	}

	if (devpriv->model == VMK8061_MODEL)

		ret = usb_find_common_endpoints(iface_desc, &ep_rx_desc,

						&ep_tx_desc, NULL, NULL);

	else

		ret = usb_find_common_endpoints(iface_desc, NULL, NULL,

						&ep_rx_desc, &ep_tx_desc);



	if (!devpriv->ep_rx || !devpriv->ep_tx)

	if (ret)

		return -ENODEV;



	devpriv->ep_rx = ep_rx_desc;

	devpriv->ep_tx = ep_tx_desc;



	return 0;

}