From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:50926 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750869AbdCOIAa (ORCPT ); Wed, 15 Mar 2017 04:00:30 -0400 Subject: Patch "USB: iowarrior: fix NULL-deref in write" has been added to the 4.9-stable tree To: johan@kernel.org, gregkh@linuxfoundation.org Cc: , From: Date: Wed, 15 Mar 2017 15:59:09 +0800 Message-ID: <148956474923863@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled USB: iowarrior: fix NULL-deref in write to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: usb-iowarrior-fix-null-deref-in-write.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From de46e56653de7b3b54baa625bd582635008b8d05 Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Tue, 7 Mar 2017 16:11:04 +0100 Subject: USB: iowarrior: fix NULL-deref in write From: Johan Hovold commit de46e56653de7b3b54baa625bd582635008b8d05 upstream. Make sure to verify that we have the required interrupt-out endpoint for IOWarrior56 devices to avoid dereferencing a NULL-pointer in write should a malicious device lack such an endpoint. Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.") Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/misc/iowarrior.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/usb/misc/iowarrior.c +++ b/drivers/usb/misc/iowarrior.c @@ -798,6 +798,14 @@ static int iowarrior_probe(struct usb_in goto error; } + if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) { + if (!dev->int_out_endpoint) { + dev_err(&interface->dev, "no interrupt-out endpoint found\n"); + retval = -ENODEV; + goto error; + } + } + /* we have to check the report_size often, so remember it in the endianness suitable for our machine */ dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint); if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) && Patches currently in stable-queue which might be from johan@kernel.org are queue-4.9/usb-serial-digi_acceleport-fix-oob-event-processing.patch queue-4.9/usb-serial-omninet-fix-reference-leaks-at-open.patch queue-4.9/usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch queue-4.9/usb-iowarrior-fix-null-deref-in-write.patch queue-4.9/usb-iowarrior-fix-null-deref-at-probe.patch queue-4.9/usb-serial-io_ti-fix-null-deref-in-interrupt-callback.patch queue-4.9/usb-serial-io_ti-fix-information-leak-in-completion-handler.patch queue-4.9/usb-serial-safe_serial-fix-information-leak-in-completion-handler.patch