summaryrefslogtreecommitdiff
path: root/sys/dev/usb
diff options
context:
space:
mode:
authorriastradh <riastradh@NetBSD.org>2022-03-14 16:14:11 +0000
committerriastradh <riastradh@NetBSD.org>2022-03-14 16:14:11 +0000
commit10451e2cccd79108d8dfe4b01fa7c95a781297a7 (patch)
treeed81f35f287fdbe08b01ffcd737f3d0f29567f7b /sys/dev/usb
parent46029e27e7c63f06206b826810701b42b60aad04 (diff)
umidi(4): Bail early if no endpoints.
kmem_alloc is unhappy with zero-size allocation. Reported-by: syzbot+483b984480c295979391@syzkaller.appspotmail.com
Diffstat (limited to 'sys/dev/usb')
-rw-r--r--sys/dev/usb/umidi.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/sys/dev/usb/umidi.c b/sys/dev/usb/umidi.c
index 07f76251699..6a81730ab46 100644
--- a/sys/dev/usb/umidi.c
+++ b/sys/dev/usb/umidi.c
@@ -1,4 +1,4 @@
-/* $NetBSD: umidi.c,v 1.84 2021/08/08 20:50:12 andvar Exp $ */
+/* $NetBSD: umidi.c,v 1.85 2022/03/14 16:14:11 riastradh Exp $ */
/*
* Copyright (c) 2001, 2012, 2014 The NetBSD Foundation, Inc.
@@ -32,7 +32,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: umidi.c,v 1.84 2021/08/08 20:50:12 andvar Exp $");
+__KERNEL_RCSID(0, "$NetBSD: umidi.c,v 1.85 2022/03/14 16:14:11 riastradh Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -778,6 +778,8 @@ alloc_all_endpoints_fixed_ep(struct umidi_softc *sc)
fp = umidi_get_quirk_data_from_type(sc->sc_quirk,
UMQ_TYPE_FIXED_EP);
+ if (fp->num_in_ep == 0 && fp->num_out_ep == 0)
+ return USBD_INVAL;
sc->sc_out_num_jacks = 0;
sc->sc_in_num_jacks = 0;
sc->sc_out_num_endpoints = fp->num_out_ep;
@@ -934,6 +936,8 @@ alloc_all_endpoints_yamaha(struct umidi_softc *sc)
sc->sc_in_num_jacks = 0;
}
sc->sc_endpoints_len = UMIDI_ENDPOINT_SIZE(sc);
+ if (sc->sc_endpoints_len == 0)
+ return USBD_INVAL;
sc->sc_endpoints = kmem_zalloc(sc->sc_endpoints_len, KM_SLEEP);
if (sc->sc_out_num_endpoints) {
sc->sc_out_ep = sc->sc_endpoints;