From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-lb0-f172.google.com ([209.85.217.172]:35252 "EHLO mail-lb0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752806AbcALLFu (ORCPT ); Tue, 12 Jan 2016 06:05:50 -0500 From: Johan Hovold To: linux-usb@vger.kernel.org Cc: Vladis Dronov , Johan Hovold , stable Subject: [PATCH] USB: visor: fix null-deref at probe Date: Tue, 12 Jan 2016 12:05:20 +0100 Message-Id: <1452596720-29839-1-git-send-email-johan@kernel.org> Sender: stable-owner@vger.kernel.org List-ID: Fix null-pointer dereference at probe should a (malicious) Treo device lack the expected endpoints. Specifically, the Treo port-setup hack was dereferencing the bulk-in and interrupt-in urbs without first making sure they had been allocated by core. Cc: stable Signed-off-by: Johan Hovold --- drivers/usb/serial/visor.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c index 60afb39eb73c..c53fbb3e0b8c 100644 --- a/drivers/usb/serial/visor.c +++ b/drivers/usb/serial/visor.c @@ -544,6 +544,11 @@ static int treo_attach(struct usb_serial *serial) (serial->num_interrupt_in == 0)) return 0; + if (serial->num_bulk_in < 2 || serial->num_interrupt_in < 2) { + dev_err(&serial->interface->dev, "missing endpoints\n"); + return -ENODEV; + } + /* * It appears that Treos and Kyoceras want to use the * 1st bulk in endpoint to communicate with the 2nd bulk out endpoint, -- 2.4.10