lkml.org 
[lkml]   [2016]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.10 48/64] USB: visor: fix null-deref at probe
    Date
    3.10-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johan Hovold <johan@kernel.org>

    commit cac9b50b0d75a1d50d6c056ff65c005f3224c8e0 upstream.

    Fix null-pointer dereference at probe should a (malicious) Treo device
    lack the expected endpoints.

    Specifically, the Treo port-setup hack was dereferencing the bulk-in and
    interrupt-in urbs without first making sure they had been allocated by
    core.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/serial/visor.c | 5 +++++
    1 file changed, 5 insertions(+)

    --- a/drivers/usb/serial/visor.c
    +++ b/drivers/usb/serial/visor.c
    @@ -551,6 +551,11 @@ static int treo_attach(struct usb_serial
    (serial->num_interrupt_in == 0))
    return 0;

    + if (serial->num_bulk_in < 2 || serial->num_interrupt_in < 2) {
    + dev_err(&serial->interface->dev, "missing endpoints\n");
    + return -ENODEV;
    + }
    +
    /*
    * It appears that Treos and Kyoceras want to use the
    * 1st bulk in endpoint to communicate with the 2nd bulk out endpoint,

    \
     
     \ /
      Last update: 2016-02-15 00:41    [W:4.183 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site