From: Karsten Keil <kkeil@linux-pingi.de>
To: David Miller <davem@davemloft.net>
Cc: netdev@vger.kernel.org, rucsoftsec@gmail.com, m.bachem@gmx.de
Subject: [PATCH ISDN] Add check for usb_alloc_urb() result
Date: Fri, 13 Jul 2012 10:59:46 +0200 [thread overview]
Message-ID: <1342169986-24268-1-git-send-email-kkeil@linux-pingi.de> (raw)
usb_alloc_urb() return value needs to be checked to avoid
later NULL pointer access.
Reported by rucsoftsec@gmail.com via bugzilla.kernel.org #44601.
Signed-off-by: Karsten Keil <kkeil@linux-pingi.de>
---
drivers/isdn/hardware/mISDN/hfcsusb.c | 18 +++++++++++++-----
drivers/isdn/hisax/hfc_usb.c | 18 +++++++++++++-----
2 files changed, 26 insertions(+), 10 deletions(-)
diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
index c65c344..114f3bc 100644
--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -2084,13 +2084,21 @@ hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id)
/* create the control pipes needed for register access */
hw->ctrl_in_pipe = usb_rcvctrlpipe(hw->dev, 0);
hw->ctrl_out_pipe = usb_sndctrlpipe(hw->dev, 0);
+
+ driver_info = (struct hfcsusb_vdata *)
+ hfcsusb_idtab[vend_idx].driver_info;
+
hw->ctrl_urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!hw->ctrl_urb) {
+ pr_warn("%s: No memory for control urb\n",
+ driver_info->vend_name);
+ kfree(hw);
+ return -ENOMEM;
+ }
- driver_info =
- (struct hfcsusb_vdata *)hfcsusb_idtab[vend_idx].driver_info;
- printk(KERN_DEBUG "%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n",
- hw->name, __func__, driver_info->vend_name,
- conf_str[small_match], ifnum, alt_used);
+ pr_info("%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n",
+ hw->name, __func__, driver_info->vend_name,
+ conf_str[small_match], ifnum, alt_used);
if (setup_instance(hw, dev->dev.parent))
return -EIO;
diff --git a/drivers/isdn/hisax/hfc_usb.c b/drivers/isdn/hisax/hfc_usb.c
index 84f9c81..849a807 100644
--- a/drivers/isdn/hisax/hfc_usb.c
+++ b/drivers/isdn/hisax/hfc_usb.c
@@ -1483,13 +1483,21 @@ hfc_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
usb_rcvctrlpipe(context->dev, 0);
context->ctrl_out_pipe =
usb_sndctrlpipe(context->dev, 0);
+
+ driver_info = (hfcsusb_vdata *)
+ hfcusb_idtab[vend_idx].driver_info;
+
context->ctrl_urb = usb_alloc_urb(0, GFP_KERNEL);
- driver_info =
- (hfcsusb_vdata *) hfcusb_idtab[vend_idx].
- driver_info;
- printk(KERN_INFO "HFC-S USB: detected \"%s\"\n",
- driver_info->vend_name);
+ if (!context->ctrl_urb) {
+ pr_warn("%s: No memory for control urb\n",
+ driver_info->vend_name);
+ kfree(context);
+ return -ENOMEM;
+ }
+
+ pr_info("HFC-S USB: detected \"%s\"\n",
+ driver_info->vend_name);
DBG(HFCUSB_DBG_INIT,
"HFC-S USB: Endpoint-Config: %s (if=%d alt=%d), E-Channel(%d)",
--
1.7.7
next reply other threads:[~2012-07-13 8:59 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-07-13 8:59 Karsten Keil [this message]
2012-07-18 16:44 ` [PATCH ISDN] Add check for usb_alloc_urb() result David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1342169986-24268-1-git-send-email-kkeil@linux-pingi.de \
--to=kkeil@linux-pingi.de \
--cc=davem@davemloft.net \
--cc=m.bachem@gmx.de \
--cc=netdev@vger.kernel.org \
--cc=rucsoftsec@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).