lkml.org 
[lkml]   [2019]   [Dec]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 031/177] media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()
    Date
    From: Yang Yingliang <yangyingliang@huawei.com>

    [ Upstream commit 649cd16c438f51d4cd777e71ca1f47f6e0c5e65d ]

    If usb_set_interface() failed, iface->cur_altsetting will
    not be assigned and it will be used in flexcop_usb_transfer_init()
    It may lead a NULL pointer dereference.

    Check usb_set_interface() return value in flexcop_usb_init()
    and return failed to avoid using this NULL pointer.

    Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: Sean Young <sean@mess.org>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/usb/b2c2/flexcop-usb.c | 8 +++++++-
    1 file changed, 7 insertions(+), 1 deletion(-)

    diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
    index ac4fddfd0a43f..f1807c16438dd 100644
    --- a/drivers/media/usb/b2c2/flexcop-usb.c
    +++ b/drivers/media/usb/b2c2/flexcop-usb.c
    @@ -503,7 +503,13 @@ static int flexcop_usb_transfer_init(struct flexcop_usb *fc_usb)
    static int flexcop_usb_init(struct flexcop_usb *fc_usb)
    {
    /* use the alternate setting with the larges buffer */
    - usb_set_interface(fc_usb->udev,0,1);
    + int ret = usb_set_interface(fc_usb->udev, 0, 1);
    +
    + if (ret) {
    + err("set interface failed.");
    + return ret;
    + }
    +
    switch (fc_usb->udev->speed) {
    case USB_SPEED_LOW:
    err("cannot handle USB speed because it is too slow.");
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-12-10 22:45    [W:6.325 / U:0.164 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site