diff options
| author | Griffin Kroah-Hartman <griffin@kroah.com> | 2026-07-22 10:17:39 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-02 14:29:21 +0200 |
| commit | 656bd0ccb900655e324d08c02d4cc65fadaeaa15 (patch) | |
| tree | 94997ca56df624cc3e29327a262cc9f79d16d9d2 | |
| parent | 04ab260407972e631c86f2bc576cd8e64d65b325 (diff) | |
| download | linux-656bd0ccb900655e324d08c02d4cc65fadaeaa15.tar.gz linux-656bd0ccb900655e324d08c02d4cc65fadaeaa15.zip | |
usb: core: Strengthen error handling in hub_hub_status()
commit a29496745aa335d97f617385809583241e118610 upstream.
Add additional error handling after the call to get_hub_status() in
hub_hub_status().
get_hub_status() uses usb_control_msg() which does not verify that the
message is the correct length, substituting it for
usb_control_msg_recv() would also solve this issue but increase memory
allocations.
Instead, error handling is copied from the method used in
hub_ext_port_status(), which shares the same flow of logic as
hub_hub_status().
Assisted-by: gkh_clanker_t1000
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Link: https://patch.msgid.link/20260722-usb_core_patches_2-v3-1-87622252bfdd@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/core/hub.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index e14f0245eb81..c0d8259975e3 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -968,10 +968,12 @@ static int hub_hub_status(struct usb_hub *hub, mutex_lock(&hub->status_mutex); ret = get_hub_status(hub->hdev, &hub->status->hub); - if (ret < 0) { + if (ret < (int)sizeof(hub->status->hub)) { if (ret != -ENODEV) dev_err(hub->intfdev, "%s failed (err = %d)\n", __func__, ret); + if (ret >= 0) + ret = -EIO; } else { *status = le16_to_cpu(hub->status->hub.wHubStatus); *change = le16_to_cpu(hub->status->hub.wHubChange); |