can: esd_usb: add endpoint type validation

esd_usb_probe() constructs bulk pipes for two endpoints without
verifying their transfer types:

- usb_rcvbulkpipe(dev->udev, 1) for RX (version reply, async RX data)
- usb_sndbulkpipe(dev->udev, 2) for TX (version query, CAN frames)

A malformed USB device can present these endpoints with transfer types
that differ from what the driver assumes, triggering the WARNING in
usb_submit_urb().

Use usb_find_common_endpoints() to discover and validate the first
bulk IN and bulk OUT endpoints at probe time, before any allocation.
Found pipes are saved to struct esd_usb and code uses them directly
instead of making pipes in place.

Similar to
- commit 136bed0bfd3b ("can: mcba_usb: properly check endpoint type")
which established the usb_find_common_endpoints() + stored pipes
pattern for CAN USB drivers.

Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device")
Suggested-by: Vincent Mailhol <mailhol@kernel.org>
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Reviewed-by: Vincent Mailhol <mailhol@kernel.org>
Link: https://patch.msgid.link/20260213203927.599163-1-n7l8m4@u.northwestern.edu
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

authored by

Ziyi Guo and committed by

Marc Kleine-Budde 3 months ago 968b0982 ab3f894d

+17 -13

1 changed file

expand all

drivers

net

can

usb

esd_usb.c

+17 -13

drivers/net/can/usb/esd_usb.c

··· 272 272 273 273 struct usb_anchor rx_submitted; 274 274 275 + unsigned int rx_pipe; 276 + unsigned int tx_pipe; 277 + 275 278 int net_count; 276 279 u32 version; 277 280 int rxinitdone; ··· 540 537 } 541 538 542 539 resubmit_urb: 543 - usb_fill_bulk_urb(urb, dev->udev, usb_rcvbulkpipe(dev->udev, 1), 540 + usb_fill_bulk_urb(urb, dev->udev, dev->rx_pipe, 544 541 urb->transfer_buffer, ESD_USB_RX_BUFFER_SIZE, 545 542 esd_usb_read_bulk_callback, dev); 546 543 ··· 629 626 { 630 627 int actual_length; 631 628 632 - return usb_bulk_msg(dev->udev, 633 - usb_sndbulkpipe(dev->udev, 2), 634 - msg, 629 + return usb_bulk_msg(dev->udev, dev->tx_pipe, msg, 635 630 msg->hdr.len * sizeof(u32), /* convert to # of bytes */ 636 631 &actual_length, 637 632 1000); ··· 640 639 { 641 640 int actual_length; 642 641 643 - return usb_bulk_msg(dev->udev, 644 - usb_rcvbulkpipe(dev->udev, 1), 645 - msg, 646 - sizeof(*msg), 647 - &actual_length, 648 - 1000); 642 + return usb_bulk_msg(dev->udev, dev->rx_pipe, msg, 643 + sizeof(*msg), &actual_length, 1000); 649 644 } 650 645 651 646 static int esd_usb_setup_rx_urbs(struct esd_usb *dev) ··· 674 677 675 678 urb->transfer_dma = buf_dma; 676 679 677 - usb_fill_bulk_urb(urb, dev->udev, 678 - usb_rcvbulkpipe(dev->udev, 1), 680 + usb_fill_bulk_urb(urb, dev->udev, dev->rx_pipe, 679 681 buf, ESD_USB_RX_BUFFER_SIZE, 680 682 esd_usb_read_bulk_callback, dev); 681 683 urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; ··· 899 903 /* hnd must not be 0 - MSB is stripped in txdone handling */ 900 904 msg->tx.hnd = BIT(31) | i; /* returned in TX done message */ 901 905 902 - usb_fill_bulk_urb(urb, dev->udev, usb_sndbulkpipe(dev->udev, 2), buf, 906 + usb_fill_bulk_urb(urb, dev->udev, dev->tx_pipe, buf, 903 907 msg->hdr.len * sizeof(u32), /* convert to # of bytes */ 904 908 esd_usb_write_bulk_callback, context); 905 909 ··· 1294 1298 static int esd_usb_probe(struct usb_interface *intf, 1295 1299 const struct usb_device_id *id) 1296 1300 { 1301 + struct usb_endpoint_descriptor *ep_in, *ep_out; 1297 1302 struct esd_usb *dev; 1298 1303 union esd_usb_msg *msg; 1299 1304 int i, err; 1305 + 1306 + err = usb_find_common_endpoints(intf->cur_altsetting, &ep_in, &ep_out, 1307 + NULL, NULL); 1308 + if (err) 1309 + return err; 1300 1310 1301 1311 dev = kzalloc_obj(*dev); 1302 1312 if (!dev) { ··· 1311 1309 } 1312 1310 1313 1311 dev->udev = interface_to_usbdev(intf); 1312 + dev->rx_pipe = usb_rcvbulkpipe(dev->udev, ep_in->bEndpointAddress); 1313 + dev->tx_pipe = usb_sndbulkpipe(dev->udev, ep_out->bEndpointAddress); 1314 1314 1315 1315 init_usb_anchor(&dev->rx_submitted); 1316 1316

Configure Feed

Configure Feed