14	    if (pegasus->data_len < 5) {
   315			dev_err(&intf->dev, "Invalid number of wMaxPacketSize\n");
   316			error = -EINVAL;
   317			goto err_free_mem;
   318		}
   319	
   320		pegasus->data = usb_alloc_coherent(dev, pegasus->data_len, GFP_KERNEL,
   321						   &pegasus->data_dma);
   322		if (!pegasus->data) {
   323			error = -ENOMEM;
   324			goto err_free_mem;
   325		}
   326	
   327		pegasus->irq = usb_alloc_urb(0, GFP_KERNEL);
   328		if (!pegasus->irq) {
   329			error = -ENOMEM;
   330			goto err_free_dma;
   331		}
   332	
   333		usb_fill_int_urb(pegasus->irq, dev, pipe,
   334				 pegasus->data, pegasus->data_len,
   335				 pegasus_irq, pegasus, endpoint->bInterval);
   336	
   337		pegasus->irq->transfer_dma = pegasus->data_dma;
   338		pegasus->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
   339	
   340		if (dev->manufacturer)
   341			strscpy(pegasus->name, dev->manufacturer,
   342				sizeof(pegasus->name));
   343	
   344		if (dev->product) {
   345			if (dev->manufacturer)
   346				strlcat(pegasus->name, " ", sizeof(pegasus->name));
   347			strlcat(pegasus->name, dev->product, sizeof(pegasus->name));
   348		}
   349	
   350		if (!strlen(pegasus->name))
   351			snprintf(pegasus->name, sizeof(pegasus->name),
   352				 "USB Pegasus Device %04x:%04x",
   353				 le16_to_cpu(dev->descriptor.idVendor),
   354				 le16_to_cpu(dev->descriptor.idProduct));
   355	
   356		usb_make_path(dev, pegasus->phys, sizeof(pegasus->phys));
   357		strlcat(pegasus->phys, "/input0", sizeof(pegasus->phys));
   358	
   359		INIT_WORK(&pegasus->init, pegasus_init);
   360	
   361		usb_set_intfdata(intf, pegasus);
   362	
   363		input_dev->name = pegasus->name;
   364		input_dev->phys = pegasus->phys;
   365		usb_to_input_id(dev, &input_dev->id);
   366		input_dev->dev.parent = &intf->dev;
   367	
   368		input_set_drvdata(input_dev, pegasus);
   369	
   370		input_dev->open = pegasus_open;
   371		input_dev->close = pegasus_close;
   372	
   373		__set_bit(EV_ABS, input_dev->evbit);
   374		__set_bit(EV_KEY, input_dev->evbit);
   375	
   376		__set_bit(ABS_X, input_dev->absbit);
   377		__set_bit(ABS_Y, input_dev->absbit);
   378	
   379		__set_bit(BTN_TOUCH, input_dev->keybit);
   380		__set_bit(BTN_RIGHT, input_dev->keybit);
   381		__set_bit(BTN_TOOL_PEN, input_dev->keybit);
   382	
   383		__set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
   384		__set_bit(INPUT_PROP_POINTER, input_dev->propbit);
   385	
   386		input_set_abs_params(input_dev, ABS_X, -1500, 1500, 8, 0);
   387		input_set_abs_params(input_dev, ABS_Y, 1600, 3000, 8, 0);
   388	
   389		error = input_register_device(pegasus->dev);
   390		if (error)
   391			goto err_free_urb;
   392	
   393		return 0;
   394	
   395	err_free_urb:
   396		usb_free_urb(pegasus->irq);
   397	err_free_dma:
   398		usb_free_coherent(dev, pegasus->data_len,
   399				  pegasus->data, pegasus->data_dma);
   400	err_free_mem:
   401		input_free_device(input_dev);
   402		kfree(pegasus);
   403		usb_set_intfdata(intf, NULL);
   404	
   405		return error;
   406	}
   407	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki[PATCH] Input: pegasus-notetaker - fix out-of-bounds access vulnerability in pegasus_parse_packet() function of the pegasus driverkernel test robot <lkp@intel.com> undefinedpip-izony <eeodqql09@gmail.com>, Dmitry Torokhov <dmitry.torokhov@gmail.com> undefined undefined undefined undefined undefined undefined undefined„