All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Hansjoerg Lipp <hjlipp@web.de>,
	Johan Hovold <johan@kernel.org>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.9 19/24] isdn/gigaset: fix NULL-deref at probe
Date: Fri, 24 Mar 2017 18:58:52 +0100	[thread overview]
Message-ID: <20170324151226.464740182@linuxfoundation.org> (raw)
In-Reply-To: <20170324151225.378075203@linuxfoundation.org>

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 68c32f9c2a36d410aa242e661506e5b2c2764179 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.

Fixes: cf7776dc05b8 ("[PATCH] isdn4linux: Siemens Gigaset drivers - direct USB connection")
Cc: Hansjoerg Lipp <hjlipp@web.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/isdn/gigaset/bas-gigaset.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -2317,6 +2317,9 @@ static int gigaset_probe(struct usb_inte
 		return -ENODEV;
 	}
 
+	if (hostif->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	dev_info(&udev->dev,
 		 "%s: Device matched (Vendor: 0x%x, Product: 0x%x)\n",
 		 __func__, le16_to_cpu(udev->descriptor.idVendor),

  parent reply	other threads:[~2017-03-24 18:16 UTC|newest]

Thread overview: 29+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-03-24 17:58 [PATCH 4.9 00/24] 4.9.18-stable review Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 01/24] drm/vc4: Fix termination of the initial scan for branch targets Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 02/24] drm/vc4: Use runtime autosuspend to avoid thrashing V3D power state Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 03/24] give up on gcc ilog2() constant optimizations Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 04/24] qla2xxx: Fix memory leak for abts processing Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 05/24] qla2xxx: Fix request queue corruption Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 06/24] parisc: Optimize flush_kernel_vmap_range and invalidate_kernel_vmap_range Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 07/24] parisc: Fix system shutdown halt Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 08/24] perf/core: Fix use-after-free in perf_release() Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 09/24] perf/core: Fix event inheritance on fork() Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 10/24] xprtrdma: Squelch kbuild sparse complaint Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 11/24] NFS prevent double free in async nfs4_exchange_id Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 12/24] cpufreq: Fix and clean up show_cpuinfo_cur_freq() Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 13/24] powerpc/boot: Fix zImage TOC alignment Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 14/24] md/raid1/10: fix potential deadlock Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 15/24] target/pscsi: Fix TYPE_TAPE + TYPE_MEDIMUM_CHANGER export Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 16/24] scsi: lpfc: Add shutdown method for kexec Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 17/24] scsi: libiscsi: add lock around task lists to fix list corruption regression Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 18/24] target: Fix VERIFY_16 handling in sbc_parse_cdb Greg Kroah-Hartman
2017-03-24 17:58 ` Greg Kroah-Hartman [this message]
2017-03-24 17:58 ` [PATCH 4.9 20/24] gfs2: Avoid alignment hole in struct lm_lockname Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 21/24] percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 22/24] cgroup/pids: remove spurious suspicious RCU usage warning Greg Kroah-Hartman
2017-03-24 17:58 ` [PATCH 4.9 24/24] ext4: fix fencepost in s_first_meta_bg validation Greg Kroah-Hartman
2017-03-25  0:01 ` [PATCH 4.9 00/24] 4.9.18-stable review Shuah Khan
     [not found] ` <58d5a33b.d426190a.e050f.3547@mx.google.com>
     [not found]   ` <m260iydy8p.fsf@baylibre.com>
2017-03-25  1:41     ` Javier Martinez Canillas
2017-03-27 16:55       ` Kevin Hilman
2017-03-27 17:25         ` Javier Martinez Canillas
2017-03-25  4:18 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170324151226.464740182@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=hjlipp@web.de \
    --cc=johan@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.