Re: [PATCH] i2c: cp2615: fix serial string NULL-deref at probe

[Johan Hovold <johan@kernel.org>]

On Wed, Mar 11, 2026 at 10:40:19PM +0100, Bence Csókás wrote:
> Reviewed-by: Bence Csókás <bence98@sch.bme.hu>
> 
> On 3/9/26 08:50, Johan Hovold wrote:
> > The cp2615 driver uses the USB device serial string as the i2c adapter
> > name but does not make sure that the string exists.
> > 
> > Verify that the device has a serial number before accessing it to avoid
> > triggering a NULL-pointer dereference (e.g. with malicious devices).

> > @@ -297,6 +297,9 @@ cp2615_i2c_probe(struct usb_interface *usbif, const struct usb_device_id *id)
> >   	if (!adap)
> >   		return -ENOMEM;
> >   
> > +	if (!usbdev->serial)
> > +		return -EINVAL;
> > +
> >   	strscpy(adap->name, usbdev->serial, sizeof(adap->name));
> >   	adap->owner = THIS_MODULE;
> >   	adap->dev.parent = &usbif->dev;

> AFAIK real CP2615s will always have a serial, so returning error should 
> not be a major problem.

That's my reasoning as well. In the unlikely event that there'll ever be
valid firmware without a serial string we can amend the driver.

Johan