lkml.org 
[lkml]   [2017]   [Mar]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 170/370] USB: serial: oti6858: fix NULL-deref at open
    3.16.42-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johan Hovold <johan@kernel.org>

    commit 5afeef2366db14587b65558bbfd5a067542e07fb upstream.

    Fix NULL-pointer dereference in open() should the device lack the
    expected endpoints:

    Unable to handle kernel NULL pointer dereference at virtual address 00000030
    ...
    PC is at oti6858_open+0x30/0x1d0 [oti6858]

    Note that a missing interrupt-in endpoint would have caused open() to
    fail.

    Fixes: 49cdee0ed0fc ("USB: oti6858 usb-serial driver (in Nokia CA-42
    cable)")
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/usb/serial/oti6858.c | 16 ++++++++++++++++
    1 file changed, 16 insertions(+)

    --- a/drivers/usb/serial/oti6858.c
    +++ b/drivers/usb/serial/oti6858.c
    @@ -134,6 +134,7 @@ static int oti6858_chars_in_buffer(struc
    static int oti6858_tiocmget(struct tty_struct *tty);
    static int oti6858_tiocmset(struct tty_struct *tty,
    unsigned int set, unsigned int clear);
    +static int oti6858_attach(struct usb_serial *serial);
    static int oti6858_port_probe(struct usb_serial_port *port);
    static int oti6858_port_remove(struct usb_serial_port *port);

    @@ -158,6 +159,7 @@ static struct usb_serial_driver oti6858_
    .write_bulk_callback = oti6858_write_bulk_callback,
    .write_room = oti6858_write_room,
    .chars_in_buffer = oti6858_chars_in_buffer,
    + .attach = oti6858_attach,
    .port_probe = oti6858_port_probe,
    .port_remove = oti6858_port_remove,
    };
    @@ -324,6 +326,20 @@ static void send_data(struct work_struct
    usb_serial_port_softint(port);
    }

    +static int oti6858_attach(struct usb_serial *serial)
    +{
    + unsigned char num_ports = serial->num_ports;
    +
    + if (serial->num_bulk_in < num_ports ||
    + serial->num_bulk_out < num_ports ||
    + serial->num_interrupt_in < num_ports) {
    + dev_err(&serial->interface->dev, "missing endpoints\n");
    + return -ENODEV;
    + }
    +
    + return 0;
    +}
    +
    static int oti6858_port_probe(struct usb_serial_port *port)
    {
    struct oti6858_private *priv;
    \
     
     \ /
      Last update: 2017-03-10 15:00    [W:6.067 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site