From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-lf0-f48.google.com ([209.85.215.48]:36120 "EHLO mail-lf0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756195AbcAYKFx (ORCPT ); Mon, 25 Jan 2016 05:05:53 -0500 Date: Mon, 25 Jan 2016 11:05:53 +0100 From: Johan Hovold To: linux-usb@vger.kernel.org Cc: Vladis Dronov , Johan Hovold , stable Subject: Re: [PATCH] USB: visor: fix null-deref at probe Message-ID: <20160125100553.GB3163@localhost> References: <1452596720-29839-1-git-send-email-johan@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1452596720-29839-1-git-send-email-johan@kernel.org> Sender: stable-owner@vger.kernel.org List-ID: On Tue, Jan 12, 2016 at 12:05:20PM +0100, Johan Hovold wrote: > Fix null-pointer dereference at probe should a (malicious) Treo device > lack the expected endpoints. > > Specifically, the Treo port-setup hack was dereferencing the bulk-in and > interrupt-in urbs without first making sure they had been allocated by > core. > > Cc: stable > Signed-off-by: Johan Hovold > --- > drivers/usb/serial/visor.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c > index 60afb39eb73c..c53fbb3e0b8c 100644 > --- a/drivers/usb/serial/visor.c > +++ b/drivers/usb/serial/visor.c > @@ -544,6 +544,11 @@ static int treo_attach(struct usb_serial *serial) > (serial->num_interrupt_in == 0)) > return 0; > > + if (serial->num_bulk_in < 2 || serial->num_interrupt_in < 2) { > + dev_err(&serial->interface->dev, "missing endpoints\n"); > + return -ENODEV; > + } > + > /* > * It appears that Treos and Kyoceras want to use the > * 1st bulk in endpoint to communicate with the 2nd bulk out endpoint, Now applied. Johan