Re: [PATCH] cypress_m8: add sanity checking

[Johan Hovold <johan@kernel.org>]

On Wed, Mar 16, 2016 at 03:19:49PM +0100, Oliver Neukum wrote:
> An attack using missing endpoints exists.
> CVE-2016-3137
> 
> Signed-off-by: Oliver Neukum <ONeukum@suse.com>
> CC: stable@vger.kernel.org
> ---
>  drivers/usb/serial/cypress_m8.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
> index 01bf533..1c6cbf5 100644
> --- a/drivers/usb/serial/cypress_m8.c
> +++ b/drivers/usb/serial/cypress_m8.c
> @@ -447,6 +447,9 @@ static int cypress_generic_port_probe(struct usb_serial_port *port)
>  	struct usb_serial *serial = port->serial;
>  	struct cypress_private *priv;
>  
> +	if (!port->interrupt_out_urb || !port->interrupt_in_urb)
> +		return -ENODEV;
> +

This look good, but would you mind adding dev_err in case the expected
endpoints are missing?

You can also remove the interrupt-in-urb check in open().

>  	priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL);
>  	if (!priv)
>  		return -ENOMEM;

Thanks,
Johan