Message ID | 20240430104137.1014471-1-zhengyejian1@huawei.com (mailing list archive) |
---|---|
State | Superseded |
Delegated to: | Sean Young |
Headers |
Received: from sv.mirrors.kernel.org ([139.178.88.99]) by linuxtv.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from <linux-media+bounces-10444-patchwork=linuxtv.org@vger.kernel.org>) id 1s1kvQ-00030b-2y for patchwork@linuxtv.org; Tue, 30 Apr 2024 10:41:30 +0000 Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 837ED285154 for <patchwork@linuxtv.org>; Tue, 30 Apr 2024 10:41:28 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 11ABE12D750; Tue, 30 Apr 2024 10:40:44 +0000 (UTC) X-Original-To: linux-media@vger.kernel.org Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2934612C47A; Tue, 30 Apr 2024 10:40:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.187 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714473643; cv=none; b=l0N19JQxicVyWT7jalwOWggXnjuaEL770YgUMezFOqlZzbpGPv1YUre3LaFRwJ1yK958ySLOJ4Xf9FHH9o23o6fyadImYCaVQYjJy+MOU793WhVQrIEIDnMPAqlQCNDZ+q64L91Fnyx8aDF7/5euatNfyn261tYWKq7vTiwZaBc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714473643; c=relaxed/simple; bh=spuDbDMDBL3D0ud6jPnHsaLTenJfMN5QsjwFYIiViXA=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=XqQ7AFEn4dWxD7q4qniN/WzBFXzTBjSZOmwsUyL6KVhSG9ehqBCJLBpboRqQm1/h3X5kMCUkU+dVYUlHrvJTADUfC+gtHZLG2lUV9dw3+uX3cbP4tuF/76VJO6OlJSXXEpHtxQ6MCBkawJNL/0YDpK+I8pk6OOFJCEWQ5msTf8o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.187 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.88.194]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4VTGq360bXzxNfM; Tue, 30 Apr 2024 18:37:19 +0800 (CST) Received: from dggpeml500012.china.huawei.com (unknown [7.185.36.15]) by mail.maildlp.com (Postfix) with ESMTPS id 31A8A14035F; Tue, 30 Apr 2024 18:40:37 +0800 (CST) Received: from localhost.localdomain (10.67.175.61) by dggpeml500012.china.huawei.com (7.185.36.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Tue, 30 Apr 2024 18:40:36 +0800 From: Zheng Yejian <zhengyejian1@huawei.com> To: <sean@mess.org>, <mchehab@kernel.org> CC: <linux-kernel@vger.kernel.org>, <linux-media@vger.kernel.org>, <zhengyejian1@huawei.com> Subject: [PATCH v2] media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control() Date: Tue, 30 Apr 2024 18:41:37 +0800 Message-ID: <20240430104137.1014471-1-zhengyejian1@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240412135256.1546051-1-zhengyejian1@huawei.com> References: <20240412135256.1546051-1-zhengyejian1@huawei.com> Precedence: bulk X-Mailing-List: linux-media@vger.kernel.org List-Id: <linux-media.vger.kernel.org> List-Subscribe: <mailto:linux-media+subscribe@vger.kernel.org> List-Unsubscribe: <mailto:linux-media+unsubscribe@vger.kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To dggpeml500012.china.huawei.com (7.185.36.15) X-LSpam-Score: -3.6 (---) X-LSpam-Report: No, score=-3.6 required=5.0 tests=ARC_SIGNED=0.001,ARC_VALID=-0.1,BAYES_00=-1.9,DMARC_QUAR=1.198,HEADER_FROM_DIFFERENT_DOMAINS=0.5,MAILING_LIST_MULTI=-1,RCVD_IN_DNSWL_MED=-2.3,SPF_HELO_NONE=0.001,SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no |
Series |
[v2] media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
|
|
Commit Message
Zheng Yejian
April 30, 2024, 10:41 a.m. UTC
Infinite log printing occurs during fuzz test:
rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ...
...
dvb-usb: schedule remote query interval to 100 msecs.
dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ...
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
...
dvb-usb: bulk message failed: -22 (1/0)
Looking into the codes, there is a loop in dvb_usb_read_remote_control(),
that is in rc_core_dvb_usb_remote_init() create a work that will call
dvb_usb_read_remote_control(), and this work will reschedule itself at
'rc_interval' intervals to recursively call dvb_usb_read_remote_control(),
see following code snippet:
rc_core_dvb_usb_remote_init() {
...
INIT_DELAYED_WORK(&d->rc_query_work, dvb_usb_read_remote_control);
schedule_delayed_work(&d->rc_query_work,
msecs_to_jiffies(rc_interval));
...
}
dvb_usb_read_remote_control() {
...
err = d->props.rc.core.rc_query(d);
if (err)
err(...) // Did not return even if query failed
schedule_delayed_work(&d->rc_query_work,
msecs_to_jiffies(rc_interval));
}
When the infinite log printing occurs, the query callback
'd->props.rc.core.rc_query' is cxusb_rc_query(). And the log is due to
the failure of finding a valid 'generic_bulk_ctrl_endpoint'
in usb_bulk_msg(), see following code snippet:
cxusb_rc_query() {
cxusb_ctrl_msg() {
dvb_usb_generic_rw() {
ret = usb_bulk_msg(d->udev, usb_sndbulkpipe(d->udev,
d->props.generic_bulk_ctrl_endpoint),...);
if (ret)
err("bulk message failed: %d (%d/%d)",ret,wlen,actlen);
...
}
...
}
By analyzing the corresponding USB descriptor, it shows that the
bNumEndpoints is 0 in its interface descriptor, but
the 'generic_bulk_ctrl_endpoint' is 1, that means user don't configure
a valid endpoint for 'generic_bulk_ctrl_endpoint', therefore this
'invalid' USB device should be rejected before it calls into
dvb_usb_read_remote_control().
To fix it, we need to add endpoint check for 'generic_bulk_ctrl_endpoint'.
And as Sean suggested, the same check and clear halts should be done for
'generic_bulk_ctrl_endpoint_response'. So introduce
dvb_usb_check_bulk_endpoint() to do it for both of them.
Fixes: 4d43e13f723e ("V4L/DVB (4643): Multi-input patch for DVB-USB device")
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
---
drivers/media/usb/dvb-usb/dvb-usb-init.c | 27 ++++++++++++++++++++----
1 file changed, 23 insertions(+), 4 deletions(-)
v2:
- As Sean suggested, check endpoint and clear halt for both
'generic_bulk_ctrl_endpoint' and 'generic_bulk_ctrl_endpoint_response'
with the new introduced dvb_usb_check_bulk_endpoint();
Link: https://lore.kernel.org/all/ZjCl97Ww6NrzJQCB@gofer.mess.org/
Link: https://lore.kernel.org/all/ZjC7rXU7ViaH60_S@gofer.mess.org/
- Add Fixes tag.
v1:
- Link: https://lore.kernel.org/all/20240412135256.1546051-1-zhengyejian1@huawei.com/
Comments
On Tue, Apr 30, 2024 at 06:41:37PM +0800, Zheng Yejian wrote: > Infinite log printing occurs during fuzz test: > > rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ... > ... > dvb-usb: schedule remote query interval to 100 msecs. > dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ... > dvb-usb: bulk message failed: -22 (1/0) > dvb-usb: bulk message failed: -22 (1/0) > dvb-usb: bulk message failed: -22 (1/0) > ... > dvb-usb: bulk message failed: -22 (1/0) > > Looking into the codes, there is a loop in dvb_usb_read_remote_control(), > that is in rc_core_dvb_usb_remote_init() create a work that will call > dvb_usb_read_remote_control(), and this work will reschedule itself at > 'rc_interval' intervals to recursively call dvb_usb_read_remote_control(), > see following code snippet: > > rc_core_dvb_usb_remote_init() { > ... > INIT_DELAYED_WORK(&d->rc_query_work, dvb_usb_read_remote_control); > schedule_delayed_work(&d->rc_query_work, > msecs_to_jiffies(rc_interval)); > ... > } > > dvb_usb_read_remote_control() { > ... > err = d->props.rc.core.rc_query(d); > if (err) > err(...) // Did not return even if query failed > schedule_delayed_work(&d->rc_query_work, > msecs_to_jiffies(rc_interval)); > } > > When the infinite log printing occurs, the query callback > 'd->props.rc.core.rc_query' is cxusb_rc_query(). And the log is due to > the failure of finding a valid 'generic_bulk_ctrl_endpoint' > in usb_bulk_msg(), see following code snippet: > > cxusb_rc_query() { > cxusb_ctrl_msg() { > dvb_usb_generic_rw() { > ret = usb_bulk_msg(d->udev, usb_sndbulkpipe(d->udev, > d->props.generic_bulk_ctrl_endpoint),...); > if (ret) > err("bulk message failed: %d (%d/%d)",ret,wlen,actlen); > ... > } > ... > } > > By analyzing the corresponding USB descriptor, it shows that the > bNumEndpoints is 0 in its interface descriptor, but > the 'generic_bulk_ctrl_endpoint' is 1, that means user don't configure > a valid endpoint for 'generic_bulk_ctrl_endpoint', therefore this > 'invalid' USB device should be rejected before it calls into > dvb_usb_read_remote_control(). > > To fix it, we need to add endpoint check for 'generic_bulk_ctrl_endpoint'. > And as Sean suggested, the same check and clear halts should be done for > 'generic_bulk_ctrl_endpoint_response'. So introduce > dvb_usb_check_bulk_endpoint() to do it for both of them. > > Fixes: 4d43e13f723e ("V4L/DVB (4643): Multi-input patch for DVB-USB device") > Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com> > --- > drivers/media/usb/dvb-usb/dvb-usb-init.c | 27 ++++++++++++++++++++---- > 1 file changed, 23 insertions(+), 4 deletions(-) > > v2: > - As Sean suggested, check endpoint and clear halt for both > 'generic_bulk_ctrl_endpoint' and 'generic_bulk_ctrl_endpoint_response' > with the new introduced dvb_usb_check_bulk_endpoint(); > Link: https://lore.kernel.org/all/ZjCl97Ww6NrzJQCB@gofer.mess.org/ > Link: https://lore.kernel.org/all/ZjC7rXU7ViaH60_S@gofer.mess.org/ > > - Add Fixes tag. > > v1: > - Link: https://lore.kernel.org/all/20240412135256.1546051-1-zhengyejian1@huawei.com/ > > diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c > index fbf58012becd..7eb321bab84f 100644 > --- a/drivers/media/usb/dvb-usb/dvb-usb-init.c > +++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c > @@ -23,6 +23,23 @@ static int dvb_usb_force_pid_filter_usage; > module_param_named(force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int, 0444); > MODULE_PARM_DESC(force_pid_filter_usage, "force all dvb-usb-devices to use a PID filter, if any (default: 0)."); > > +static int dvb_usb_check_bulk_endpoint(struct dvb_usb_device *d, u8 endpoint) > +{ > + if (endpoint) { > + int ret; > + > + ret = usb_pipe_type_check(d->udev, usb_sndbulkpipe(d->udev, endpoint)); > + if (ret) > + return ret; > + ret = usb_pipe_type_check(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); > + if (ret) > + return ret; > + usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, endpoint)); > + usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); > + } > + return 0; > +} > + > static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) > { > struct dvb_usb_adapter *adap; > @@ -103,10 +120,12 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) > * when reloading the driver w/o replugging the device > * sometimes a timeout occurs, this helps > */ > - if (d->props.generic_bulk_ctrl_endpoint != 0) { > - usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); > - usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); > - } > + ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint); > + if (ret) > + goto frontend_init_err; > + ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint_response); > + if (ret) > + goto frontend_init_err; > > return 0; This results in the following warning: drivers/media/usb/dvb-usb/dvb-usb-init.c:133:9: warning: 'adap' may be used uninitialized [-Wmaybe-uninitialized] I think these tests should be moved to the top of the function, so no cleanup is required. Sean
On 2024/5/3 19:51, Sean Young wrote: > On Tue, Apr 30, 2024 at 06:41:37PM +0800, Zheng Yejian wrote: >> Infinite log printing occurs during fuzz test: >> >> rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ... >> ... >> dvb-usb: schedule remote query interval to 100 msecs. >> dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ... >> dvb-usb: bulk message failed: -22 (1/0) >> dvb-usb: bulk message failed: -22 (1/0) >> dvb-usb: bulk message failed: -22 (1/0) >> ... >> dvb-usb: bulk message failed: -22 (1/0) >> >> Looking into the codes, there is a loop in dvb_usb_read_remote_control(), >> that is in rc_core_dvb_usb_remote_init() create a work that will call >> dvb_usb_read_remote_control(), and this work will reschedule itself at >> 'rc_interval' intervals to recursively call dvb_usb_read_remote_control(), >> see following code snippet: >> >> rc_core_dvb_usb_remote_init() { >> ... >> INIT_DELAYED_WORK(&d->rc_query_work, dvb_usb_read_remote_control); >> schedule_delayed_work(&d->rc_query_work, >> msecs_to_jiffies(rc_interval)); >> ... >> } >> >> dvb_usb_read_remote_control() { >> ... >> err = d->props.rc.core.rc_query(d); >> if (err) >> err(...) // Did not return even if query failed >> schedule_delayed_work(&d->rc_query_work, >> msecs_to_jiffies(rc_interval)); >> } >> >> When the infinite log printing occurs, the query callback >> 'd->props.rc.core.rc_query' is cxusb_rc_query(). And the log is due to >> the failure of finding a valid 'generic_bulk_ctrl_endpoint' >> in usb_bulk_msg(), see following code snippet: >> >> cxusb_rc_query() { >> cxusb_ctrl_msg() { >> dvb_usb_generic_rw() { >> ret = usb_bulk_msg(d->udev, usb_sndbulkpipe(d->udev, >> d->props.generic_bulk_ctrl_endpoint),...); >> if (ret) >> err("bulk message failed: %d (%d/%d)",ret,wlen,actlen); >> ... >> } >> ... >> } >> >> By analyzing the corresponding USB descriptor, it shows that the >> bNumEndpoints is 0 in its interface descriptor, but >> the 'generic_bulk_ctrl_endpoint' is 1, that means user don't configure >> a valid endpoint for 'generic_bulk_ctrl_endpoint', therefore this >> 'invalid' USB device should be rejected before it calls into >> dvb_usb_read_remote_control(). >> >> To fix it, we need to add endpoint check for 'generic_bulk_ctrl_endpoint'. >> And as Sean suggested, the same check and clear halts should be done for >> 'generic_bulk_ctrl_endpoint_response'. So introduce >> dvb_usb_check_bulk_endpoint() to do it for both of them. >> >> Fixes: 4d43e13f723e ("V4L/DVB (4643): Multi-input patch for DVB-USB device") >> Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com> >> --- >> drivers/media/usb/dvb-usb/dvb-usb-init.c | 27 ++++++++++++++++++++---- >> 1 file changed, 23 insertions(+), 4 deletions(-) >> >> v2: >> - As Sean suggested, check endpoint and clear halt for both >> 'generic_bulk_ctrl_endpoint' and 'generic_bulk_ctrl_endpoint_response' >> with the new introduced dvb_usb_check_bulk_endpoint(); >> Link: https://lore.kernel.org/all/ZjCl97Ww6NrzJQCB@gofer.mess.org/ >> Link: https://lore.kernel.org/all/ZjC7rXU7ViaH60_S@gofer.mess.org/ >> >> - Add Fixes tag. >> >> v1: >> - Link: https://lore.kernel.org/all/20240412135256.1546051-1-zhengyejian1@huawei.com/ >> >> diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c >> index fbf58012becd..7eb321bab84f 100644 >> --- a/drivers/media/usb/dvb-usb/dvb-usb-init.c >> +++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c >> @@ -23,6 +23,23 @@ static int dvb_usb_force_pid_filter_usage; >> module_param_named(force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int, 0444); >> MODULE_PARM_DESC(force_pid_filter_usage, "force all dvb-usb-devices to use a PID filter, if any (default: 0)."); >> >> +static int dvb_usb_check_bulk_endpoint(struct dvb_usb_device *d, u8 endpoint) >> +{ >> + if (endpoint) { >> + int ret; >> + >> + ret = usb_pipe_type_check(d->udev, usb_sndbulkpipe(d->udev, endpoint)); >> + if (ret) >> + return ret; >> + ret = usb_pipe_type_check(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); >> + if (ret) >> + return ret; >> + usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, endpoint)); >> + usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); >> + } >> + return 0; >> +} >> + >> static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) >> { >> struct dvb_usb_adapter *adap; >> @@ -103,10 +120,12 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) >> * when reloading the driver w/o replugging the device >> * sometimes a timeout occurs, this helps >> */ >> - if (d->props.generic_bulk_ctrl_endpoint != 0) { >> - usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); >> - usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); >> - } >> + ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint); >> + if (ret) >> + goto frontend_init_err; >> + ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint_response); >> + if (ret) >> + goto frontend_init_err; >> >> return 0; > > This results in the following warning: > > drivers/media/usb/dvb-usb/dvb-usb-init.c:133:9: warning: 'adap' may be used uninitialized [-Wmaybe-uninitialized] > > I think these tests should be moved to the top of the function, so no cleanup > is required. > Hi, Sean, I have fixed the warning in v3: https://lore.kernel.org/all/20240509124414.1392304-1-zhengyejian1@huawei.com/, would you mind taking a look at it ? I introduce a new funciton dvb_usb_clear_halt() to clear sndbulkpipe and rcvbulkpipe, dvb_usb_check_bulk_endpoint() only do pipe type check and is moved to the top of the function. -- Thanks, Zheng Yejian > > Sean
diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c index fbf58012becd..7eb321bab84f 100644 --- a/drivers/media/usb/dvb-usb/dvb-usb-init.c +++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c @@ -23,6 +23,23 @@ static int dvb_usb_force_pid_filter_usage; module_param_named(force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int, 0444); MODULE_PARM_DESC(force_pid_filter_usage, "force all dvb-usb-devices to use a PID filter, if any (default: 0)."); +static int dvb_usb_check_bulk_endpoint(struct dvb_usb_device *d, u8 endpoint) +{ + if (endpoint) { + int ret; + + ret = usb_pipe_type_check(d->udev, usb_sndbulkpipe(d->udev, endpoint)); + if (ret) + return ret; + ret = usb_pipe_type_check(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); + if (ret) + return ret; + usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, endpoint)); + usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); + } + return 0; +} + static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) { struct dvb_usb_adapter *adap; @@ -103,10 +120,12 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) * when reloading the driver w/o replugging the device * sometimes a timeout occurs, this helps */ - if (d->props.generic_bulk_ctrl_endpoint != 0) { - usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); - usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); - } + ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint); + if (ret) + goto frontend_init_err; + ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint_response); + if (ret) + goto frontend_init_err; return 0;