Patch "Input: ims-pcu - sanity check against missing interfaces" has been added to the 4.4-stable tree

Patch "Input: ims-pcu - sanity check against missing interfaces" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    Input: ims-pcu - sanity check against missing interfaces

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     input-ims-pcu-sanity-check-against-missing-interfaces.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 17 Mar 2016 14:00:17 -0700
Subject: Input: ims-pcu - sanity check against missing interfaces

From: Oliver Neukum <oneukum@suse.com>

commit a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff upstream.

A malicious device missing interface can make the driver oops.
Add sanity checking.

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/misc/ims-pcu.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1663,6 +1663,8 @@ static int ims_pcu_parse_cdc_data(struct
 
 	pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev,
 					 union_desc->bMasterInterface0);
+	if (!pcu->ctrl_intf)
+		return -EINVAL;
 
 	alt = pcu->ctrl_intf->cur_altsetting;
 	pcu->ep_ctrl = &alt->endpoint[0].desc;
@@ -1670,6 +1672,8 @@ static int ims_pcu_parse_cdc_data(struct
 
 	pcu->data_intf = usb_ifnum_to_if(pcu->udev,
 					 union_desc->bSlaveInterface0);
+	if (!pcu->data_intf)
+		return -EINVAL;
 
 	alt = pcu->data_intf->cur_altsetting;
 	if (alt->desc.bNumEndpoints != 2) {


Patches currently in stable-queue which might be from oneukum@suse.com are

queue-4.4/usb-cdc-acm-more-sanity-checking.patch
queue-4.4/usb-mct_u232-add-sanity-checking-in-probe.patch
queue-4.4/usb-digi_acceleport-do-sanity-checking-for-the-number-of-ports.patch
queue-4.4/input-ims-pcu-sanity-check-against-missing-interfaces.patch
queue-4.4/usb-cypress_m8-add-endpoint-sanity-check.patch
queue-4.4/usb-retry-reset-if-a-device-times-out.patch
queue-4.4/usb-hub-fix-a-typo-in-hub_port_init-leading-to-wrong-logic.patch
queue-4.4/usb-usb_driver_claim_interface-add-sanity-checking.patch