Re: [PATCH net] net: usb: pegasus: validate USB endpoints

[Alan Stern <stern@rowland.harvard.edu>]

On Mon, Feb 23, 2026 at 01:58:48PM +0100, Greg Kroah-Hartman wrote:
> The pegasus driver should validate that the device it is probing has the
> proper number and types of USB endpoints it is expecting before it binds
> to it.  If a malicious device were to not have the same urbs the driver
> will crash later on when it blindly accesses these endpoints.
> 
> Cc: Petko Manolov <petkan@nucleusys.com>
> Cc: stable <stable@kernel.org>
> Assisted-by: gkh_clanker_2000
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---

This does much the same thing as

https://lore.kernel.org/linux-usb/20260222050633.410165-1-n7l8m4@u.northwestern.edu/T/#u

and that patch also removes some magic numbers.

BTW, what is gkh_clanker_2000?

Alan Stern

>  drivers/net/usb/pegasus.c | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
> index 4f539b5d509a..94c17fed0bd4 100644
> --- a/drivers/net/usb/pegasus.c
> +++ b/drivers/net/usb/pegasus.c
> @@ -801,8 +801,19 @@ static void unlink_all_urbs(pegasus_t *pegasus)
>  
>  static int alloc_urbs(pegasus_t *pegasus)
>  {
> +	static const u8 bulk_ep_addr[] = {
> +		1 | USB_DIR_IN,
> +		2 | USB_DIR_OUT,
> +		0};
> +	static const u8 int_ep_addr[] = {
> +		3 | USB_DIR_IN,
> +		0};
>  	int res = -ENOMEM;
>  
> +	if (!usb_check_bulk_endpoints(pegasus->intf, bulk_ep_addr) ||
> +	    !usb_check_int_endpoints(pegasus->intf, int_ep_addr))
> +		return -ENODEV;
> +
>  	pegasus->rx_urb = usb_alloc_urb(0, GFP_KERNEL);
>  	if (!pegasus->rx_urb) {
>  		return res;
> @@ -1143,6 +1154,7 @@ static int pegasus_probe(struct usb_interface *intf,
>  
>  	pegasus = netdev_priv(net);
>  	pegasus->dev_index = dev_index;
> +	pegasus->intf = intf;
>  
>  	res = alloc_urbs(pegasus);
>  	if (res < 0) {
> @@ -1154,7 +1166,6 @@ static int pegasus_probe(struct usb_interface *intf,
>  
>  	INIT_DELAYED_WORK(&pegasus->carrier_check, check_carrier);
>  
> -	pegasus->intf = intf;
>  	pegasus->usb = dev;
>  	pegasus->net = net;
>  
> -- 
> 2.53.0
> 
>