From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Alan Stern <stern@rowland.harvard.edu>,
Andrey Konovalov <andreyknvl@google.com>,
Felipe Balbi <felipe.balbi@linux.intel.com>,
Ben Hutchings <ben.hutchings@codethink.co.uk>
Subject: [PATCH 3.18 05/20] usb: usbtest: fix NULL pointer dereference
Date: Thu, 16 Nov 2017 18:28:12 +0100 [thread overview]
Message-ID: <20171116172721.973241893@linuxfoundation.org> (raw)
In-Reply-To: <20171116172721.759231192@linuxfoundation.org>
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 7c80f9e4a588f1925b07134bb2e3689335f6c6d8 upstream.
If the usbtest driver encounters a device with an IN bulk endpoint but
no OUT bulk endpoint, it will try to dereference a NULL pointer
(out->desc.bEndpointAddress). The problem can be solved by adding a
missing test.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/usbtest.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -183,12 +183,13 @@ found:
return tmp;
}
- if (in) {
+ if (in)
dev->in_pipe = usb_rcvbulkpipe(udev,
in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+ if (out)
dev->out_pipe = usb_sndbulkpipe(udev,
out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
- }
+
if (iso_in) {
dev->iso_in = &iso_in->desc;
dev->in_iso_pipe = usb_rcvisocpipe(udev,
next prev parent reply other threads:[~2017-11-16 17:31 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-16 17:28 [PATCH 3.18 00/20] 3.18.82-stable review Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 01/20] [PATCH] Revert "ceph: unlock dangling spinlock in try_flush_caps()" Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 02/20] mac80211: accept key reinstall without changing anything Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 03/20] mac80211: use constant time comparison with keys Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 04/20] mac80211: dont compare TKIP TX MIC key in reinstall prevention Greg Kroah-Hartman
2017-11-16 17:28 ` Greg Kroah-Hartman [this message]
2017-11-16 17:28 ` [PATCH 3.18 06/20] Input: ims-psu - check if CDC union descriptor is sane Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 08/20] tun/tap: sanitize TUNSETSNDBUF input Greg Kroah-Hartman
2017-11-16 21:25 ` Craig Gallek
2017-11-17 7:59 ` Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 09/20] tcp: fix tcp_mtu_probe() vs highest_sack Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 10/20] l2tp: check ps->sock before running pppol2tp_session_ioctl() Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 11/20] tun: call dev_get_valid_name() before register_netdevice() Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 12/20] sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 13/20] net/unix: dont show information about sockets from other namespaces Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 14/20] tun: allow positive return values on dev_get_valid_name() call Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 15/20] sctp: reset owner sk for data chunks on out queues when migrating a sock Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 16/20] ipv6: flowlabel: do not leave opt->tot_len with garbage Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 17/20] ipip: only increase err_count for some certain type icmp in ipip_err Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 18/20] ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 19/20] security/keys: add CONFIG_KEYS_COMPAT to Kconfig Greg Kroah-Hartman
2017-11-16 17:28 ` [PATCH 3.18 20/20] target/iscsi: Fix iSCSI task reassignment handling Greg Kroah-Hartman
2017-11-16 22:43 ` [PATCH 3.18 00/20] 3.18.82-stable review Shuah Khan
2017-11-17 2:00 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171116172721.973241893@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andreyknvl@google.com \
--cc=ben.hutchings@codethink.co.uk \
--cc=felipe.balbi@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.