USB: usbfs: Filter flags passed in from user space
USBDEVFS_URB_ISO_ASAP must be accepted only for ISO endpoints. Improve sanity checking. Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Oliver Neukum <oneukum@suse.com> Cc: stable <stable@vger.kernel.org> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
a7c42106ea
commit
446f666da9
|
@ -1442,14 +1442,18 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
|
|||
int number_of_packets = 0;
|
||||
unsigned int stream_id = 0;
|
||||
void *buf;
|
||||
|
||||
if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
|
||||
USBDEVFS_URB_SHORT_NOT_OK |
|
||||
unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK |
|
||||
USBDEVFS_URB_BULK_CONTINUATION |
|
||||
USBDEVFS_URB_NO_FSBR |
|
||||
USBDEVFS_URB_ZERO_PACKET |
|
||||
USBDEVFS_URB_NO_INTERRUPT))
|
||||
return -EINVAL;
|
||||
USBDEVFS_URB_NO_INTERRUPT;
|
||||
/* USBDEVFS_URB_ISO_ASAP is a special case */
|
||||
if (uurb->type == USBDEVFS_URB_TYPE_ISO)
|
||||
mask |= USBDEVFS_URB_ISO_ASAP;
|
||||
|
||||
if (uurb->flags & ~mask)
|
||||
return -EINVAL;
|
||||
|
||||
if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
|
||||
return -EINVAL;
|
||||
if (uurb->buffer_length > 0 && !uurb->buffer)
|
||||
|
|
Loading…
Reference in a new issue