Unverified Commit fa19038d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!8398 comedi: ni_usb6501: fix NULL-deref in command paths 

Merge Pull Request from: @ci-robot 
 
PR sync from: Cui GaoSheng <cuigaosheng1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/IC5H4AWTHAAJ6XROLRHOIVWJEFC2ICG5/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9RD2V 
 
Link:https://gitee.com/openeuler/kernel/pulls/8398

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 448a52e3 7e51492b

drivers/staging/comedi/drivers/ni_usb6501.c

+10 −0
Original line number Diff line number Diff line
@@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10, 
					   0x00, 0x00, 0x00, 0x02,

					   0x00, 0x00, 0x00, 0x00};



/* Largest supported packets */

static const size_t TX_MAX_SIZE	= sizeof(SET_PORT_DIR_REQUEST);

static const size_t RX_MAX_SIZE	= sizeof(READ_PORT_RESPONSE);



enum commands {

	READ_PORT,

	WRITE_PORT,
@@ -501,6 +505,12 @@ static int ni6501_find_endpoints(struct comedi_device *dev) 
	if (!devpriv->ep_rx || !devpriv->ep_tx)

		return -ENODEV;



	if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE)

		return -ENODEV;



	if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE)

		return -ENODEV;



	return 0;

}