[media.git/next] media: lmedm04: Handle errors for lme2510_int_read

[media-ci]

On Tue May 21 17:10:42 2024 +0800, Chen Ni wrote:
> Add check for the return value of usb_pipe_endpoint() and
> usb_submit_urb() in order to catch the errors.
> 
> Fixes: 15e1ce33182d ("[media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, 
> pipe 1 != type 3 in interrupt urb")
> Signed-off-by: Chen Ni <nic...@iscas.ac.cn>
> Link: https://lore.kernel.org/r/20240521091042.1769684-1-nic...@iscas.ac.cn
> Signed-off-by: Mauro Carvalho Chehab <mche...@kernel.org>

Patch committed.

Thanks,
Mauro Carvalho Chehab

 drivers/media/usb/dvb-usb-v2/lmedm04.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

---

diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c 
b/drivers/media/usb/dvb-usb-v2/lmedm04.c
index 8a34e6c0d6a6..f0537b741d13 100644
--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
+++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
@@ -373,6 +373,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
        struct dvb_usb_device *d = adap_to_d(adap);
        struct lme2510_state *lme_int = adap_to_priv(adap);
        struct usb_host_endpoint *ep;
+       int ret;
 
        lme_int->lme_urb = usb_alloc_urb(0, GFP_KERNEL);
 
@@ -390,11 +391,20 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
 
        /* Quirk of pipe reporting PIPE_BULK but behaves as interrupt */
        ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe);
+       if (!ep) {
+               usb_free_urb(lme_int->lme_urb);
+               return -ENODEV;
+       }
 
        if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
                lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa);
 
-       usb_submit_urb(lme_int->lme_urb, GFP_KERNEL);
+       ret = usb_submit_urb(lme_int->lme_urb, GFP_KERNEL);
+       if (ret) {
+               usb_free_urb(lme_int->lme_urb);
+               return ret;
+       }
+
        info("INT Interrupt Service Started");
 
        return 0;