Patch "USB: serial: mos7840: fix another NULL-deref at open" has been added to the 4.4-stable tree

Patch "USB: serial: mos7840: fix another NULL-deref at open" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    USB: serial: mos7840: fix another NULL-deref at open

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-serial-mos7840-fix-another-null-deref-at-open.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 5182c2cf2a9bfb7f066ef0bdd2bb6330b94dd74e Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 9 Feb 2017 12:11:41 +0100
Subject: USB: serial: mos7840: fix another NULL-deref at open

From: Johan Hovold <johan@kernel.org>

commit 5182c2cf2a9bfb7f066ef0bdd2bb6330b94dd74e upstream.

Fix another NULL-pointer dereference at open should a malicious device
lack an interrupt-in endpoint.

Note that the driver has a broken check for an interrupt-in endpoint
which means that an interrupt URB has never even been submitted.

Fixes: 3f5429746d91 ("USB: Moschip 7840 USB-Serial Driver")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/mos7840.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1024,6 +1024,7 @@ static int mos7840_open(struct tty_struc
 	 * (can't set it up in mos7840_startup as the structures *
 	 * were not set up at that time.)                        */
 	if (port0->open_ports == 1) {
+		/* FIXME: Buffer never NULL, so URB is not submitted. */
 		if (serial->port[0]->interrupt_in_buffer == NULL) {
 			/* set up interrupt urb */
 			usb_fill_int_urb(serial->port[0]->interrupt_in_urb,
@@ -2119,7 +2120,8 @@ static int mos7840_calc_num_ports(struct
 static int mos7840_attach(struct usb_serial *serial)
 {
 	if (serial->num_bulk_in < serial->num_ports ||
-			serial->num_bulk_out < serial->num_ports) {
+			serial->num_bulk_out < serial->num_ports ||
+			serial->num_interrupt_in < 1) {
 		dev_err(&serial->interface->dev, "missing endpoints\n");
 		return -ENODEV;
 	}


Patches currently in stable-queue which might be from johan@kernel.org are

queue-4.4/usb-serial-ftdi_sio-fix-modem-status-error-handling.patch
queue-4.4/usb-serial-cp210x-add-new-ids-for-ge-bx50v3-boards.patch
queue-4.4/usb-serial-ark3116-fix-register-accessor-error-handling.patch
queue-4.4/usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch
queue-4.4/usb-serial-ftdi_sio-fix-line-status-over-reporting.patch
queue-4.4/usb-serial-ftdi_sio-fix-extreme-low-latency-setting.patch
queue-4.4/usb-serial-spcp8x5-fix-modem-status-handling.patch
queue-4.4/usb-serial-opticon-fix-cts-retrieval-at-open.patch
queue-4.4/usb-serial-mos7840-fix-another-null-deref-at-open.patch