Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1587411

[PATCH 4.10 05/21] USB: serial: mos7840: fix another NULL-deref at open

Show all headers | View raw

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 5182c2cf2a9bfb7f066ef0bdd2bb6330b94dd74e upstream.

Fix another NULL-pointer dereference at open should a malicious device
lack an interrupt-in endpoint.

Note that the driver has a broken check for an interrupt-in endpoint
which means that an interrupt URB has never even been submitted.

Fixes: 3f5429746d91 ("USB: Moschip 7840 USB-Serial Driver")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/mos7840.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1023,6 +1023,7 @@ static int mos7840_open(struct tty_struc
 	 * (can't set it up in mos7840_startup as the structures *
 	 * were not set up at that time.)                        */
 	if (port0->open_ports == 1) {
+		/* FIXME: Buffer never NULL, so URB is not submitted. */
 		if (serial->port[0]->interrupt_in_buffer == NULL) {
 			/* set up interrupt urb */
 			usb_fill_int_urb(serial->port[0]->interrupt_in_urb,
@@ -2106,7 +2107,8 @@ static int mos7840_calc_num_ports(struct
 static int mos7840_attach(struct usb_serial *serial)
 {
 	if (serial->num_bulk_in < serial->num_ports ||
-			serial->num_bulk_out < serial->num_ports) {
+			serial->num_bulk_out < serial->num_ports ||
+			serial->num_interrupt_in < 1) {
 		dev_err(&serial->interface->dev, "missing endpoints\n");
 		return -ENODEV;
 	}

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.10 00/21] 4.10.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.10 13/21] USB: serial: ark3116: fix register-accessor error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.10 06/21] USB: serial: cp210x: add new IDs for GE Bx50v3 boards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.10 10/21] USB: serial: digi_acceleport: fix OOB data sanity check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.10 16/21] goldfish: Sanitize the broken interrupt handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.10 20/21] rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.10 14/21] USB: serial: console: fix uninitialised spinlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.10 04/21] tty: serial: msm: Fix module autoload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.10 15/21] x86/platform/goldfish: Prevent unconditional loading Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.10 02/21] ip: fix IP_CHECKSUM handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.10 17/21] netfilter: nf_ct_helper: warn when not applying default helper assignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.10 12/21] USB: serial: opticon: fix CTS retrieval at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.10 05/21] USB: serial: mos7840: fix another NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.10 19/21] block: fix double-free in the failure path of cgwb_bdi_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  Re: [PATCH 4.10 00/21] 4.10.1-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-02-24 19:40 +0100
    Re: [PATCH 4.10 00/21] 4.10.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-26 17:10 +0100
  Re: [PATCH 4.10 00/21] 4.10.1-stable review Guenter Roeck <linux@roeck-us.net> - 2017-02-25 05:30 +0100
    Re: [PATCH 4.10 00/21] 4.10.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-26 17:10 +0100
  Re: [PATCH 4.10 00/21] 4.10.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-26 17:10 +0100
    Re: [PATCH 4.10 00/21] 4.10.1-stable review Kevin Hilman <khilman@baylibre.com> - 2017-02-27 21:30 +0100

csiph-web