diff options
| author | Griffin Kroah-Hartman <griffin@kroah.com> | 2026-07-22 10:17:39 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-02 14:27:29 +0200 |
| commit | 8e975cdf304fef3539bf46196d7af2ddaed80aa6 (patch) | |
| tree | 7a4e69e72f06dcc59d211ab8bc9e6736c0892296 | |
| parent | 975ef630393c07fcbebf94f4d97043161b77a6ce (diff) | |
| download | linux-stable-8e975cdf304fef3539bf46196d7af2ddaed80aa6.tar.gz linux-stable-8e975cdf304fef3539bf46196d7af2ddaed80aa6.zip | |
usb: core: Strengthen error handling in hub_hub_status()
commit a29496745aa335d97f617385809583241e118610 upstream.
Add additional error handling after the call to get_hub_status() in
hub_hub_status().
get_hub_status() uses usb_control_msg() which does not verify that the
message is the correct length, substituting it for
usb_control_msg_recv() would also solve this issue but increase memory
allocations.
Instead, error handling is copied from the method used in
hub_ext_port_status(), which shares the same flow of logic as
hub_hub_status().
Assisted-by: gkh_clanker_t1000
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Link: https://patch.msgid.link/20260722-usb_core_patches_2-v3-1-87622252bfdd@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/core/hub.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index dc73a48b5f86..c26303dd0645 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -955,10 +955,12 @@ static int hub_hub_status(struct usb_hub *hub, mutex_lock(&hub->status_mutex); ret = get_hub_status(hub->hdev, &hub->status->hub); - if (ret < 0) { + if (ret < (int)sizeof(hub->status->hub)) { if (ret != -ENODEV) dev_err(hub->intfdev, "%s failed (err = %d)\n", __func__, ret); + if (ret >= 0) + ret = -EIO; } else { *status = le16_to_cpu(hub->status->hub.wHubStatus); *change = le16_to_cpu(hub->status->hub.wHubChange); |