[PATCH v7 07/10] mfd: nct6694: Validate the interrupt IN endpoint

[a0282524688@gmail.com]

From: Ming Yu <a0282524688@gmail.com>

The probe reads endpoint[0] of the current altsetting without checking
that the interface actually describes any endpoint. A device reporting
zero endpoints makes the driver read past the endpoint array.

Locate the interrupt IN endpoint with usb_find_int_in_endpoint(), which
validates the descriptor before it is used.

Fixes: 51dad33ede63 ("mfd: Add core driver for Nuvoton NCT6694")
Signed-off-by: Ming Yu <a0282524688@gmail.com>
---
Changes in v7:
- New patch. Fixes the out-of-bounds endpoint access reported on v6
  patch 6/7.

 drivers/mfd/nct6694-usb.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/drivers/mfd/nct6694-usb.c b/drivers/mfd/nct6694-usb.c
index 793ce54c02aa..c8667984df5e 100644
--- a/drivers/mfd/nct6694-usb.c
+++ b/drivers/mfd/nct6694-usb.c
@@ -266,7 +266,6 @@ static int nct6694_usb_probe(struct usb_interface *iface,
 {
 	struct usb_device *udev = interface_to_usbdev(iface);
 	struct usb_endpoint_descriptor *int_endpoint;
-	struct usb_host_interface *interface;
 	struct device *dev = &iface->dev;
 	struct nct6694_usb_data *udata;
 	struct nct6694 *nct6694;
@@ -305,13 +304,9 @@ static int nct6694_usb_probe(struct usb_interface *iface,
 	if (ret)
 		goto err_urb;
 
-	interface = iface->cur_altsetting;
-
-	int_endpoint = &interface->endpoint[0].desc;
-	if (!usb_endpoint_is_int_in(int_endpoint)) {
-		ret = -ENODEV;
+	ret = usb_find_int_in_endpoint(iface->cur_altsetting, &int_endpoint);
+	if (ret)
 		goto err_urb;
-	}
 
 	usb_fill_int_urb(udata->int_in_urb, udev, usb_rcvintpipe(udev, NCT6694_INT_IN_EP),
 			 udata->int_buffer, sizeof(*udata->int_buffer), nct6694_usb_int_callback,
-- 
2.34.1