[src/trunk]: src/sys/dev/usb umcs(4): Reject invalid interrupt endpoints.

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/dfac55eb11d6
branches:  trunk
changeset: 368173:dfac55eb11d6
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Sun Jun 26 21:35:53 2022 +0000

description:
umcs(4): Reject invalid interrupt endpoints.

Reported-by: syzbot+cd1e60e112e840e40d0a%syzkaller.appspotmail.com@localhost

diffstat:

 sys/dev/usb/umcs.c |  10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)

diffs (31 lines):

diff -r 7bddf3965f55 -r dfac55eb11d6 sys/dev/usb/umcs.c
--- a/sys/dev/usb/umcs.c        Sun Jun 26 21:00:28 2022 +0000
+++ b/sys/dev/usb/umcs.c        Sun Jun 26 21:35:53 2022 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: umcs.c,v 1.19 2022/04/19 01:35:28 riastradh Exp $ */
+/* $NetBSD: umcs.c,v 1.20 2022/06/26 21:35:53 riastradh Exp $ */
 /* $FreeBSD: head/sys/dev/usb/serial/umcs.c 260559 2014-01-12 11:44:28Z hselasky $ */
 
 /*-
@@ -41,7 +41,7 @@
  *
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: umcs.c,v 1.19 2022/04/19 01:35:28 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: umcs.c,v 1.20 2022/06/26 21:35:53 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -276,6 +276,12 @@
                sc->sc_dying = true;
                return;
        }
+       if (sc->sc_intr_buflen == 0) {
+               aprint_error_dev(self, "invalid interrupt endpoint"
+                   " (addr %d)\n", intr_addr);
+               sc->sc_dying = true;
+               return;
+       }
        sc->sc_intr_buf = kmem_alloc(sc->sc_intr_buflen, KM_SLEEP);
 
        error = usbd_open_pipe_intr(sc->sc_iface, intr_addr,