diff options
| author | Griffin Kroah-Hartman <griffin@kroah.com> | 2026-07-22 10:17:39 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-02 14:28:36 +0200 |
| commit | e4505facd9dfc2f761d2112e350ed6e4e6dd02f8 (patch) | |
| tree | 20a37cfd0fe2ef71819bf3f7ee41cbe15eeab3d1 | |
| parent | 71cfda2fdf78041a01e9d94143baa79feabbdbf6 (diff) | |
| download | linux-e4505facd9dfc2f761d2112e350ed6e4e6dd02f8.tar.gz linux-e4505facd9dfc2f761d2112e350ed6e4e6dd02f8.zip | |
usb: core: Strengthen error handling in hub_hub_status()
commit a29496745aa335d97f617385809583241e118610 upstream.
Add additional error handling after the call to get_hub_status() in
hub_hub_status().
get_hub_status() uses usb_control_msg() which does not verify that the
message is the correct length, substituting it for
usb_control_msg_recv() would also solve this issue but increase memory
allocations.
Instead, error handling is copied from the method used in
hub_ext_port_status(), which shares the same flow of logic as
hub_hub_status().
Assisted-by: gkh_clanker_t1000
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Link: https://patch.msgid.link/20260722-usb_core_patches_2-v3-1-87622252bfdd@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/core/hub.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 3c5e212295fa..d7ae3eabc534 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -968,10 +968,12 @@ static int hub_hub_status(struct usb_hub *hub, mutex_lock(&hub->status_mutex); ret = get_hub_status(hub->hdev, &hub->status->hub); - if (ret < 0) { + if (ret < (int)sizeof(hub->status->hub)) { if (ret != -ENODEV) dev_err(hub->intfdev, "%s failed (err = %d)\n", __func__, ret); + if (ret >= 0) + ret = -EIO; } else { *status = le16_to_cpu(hub->status->hub.wHubStatus); *change = le16_to_cpu(hub->status->hub.wHubChange); |