[PATCH 3/6] USB: uss720: fix NULL-deref at probe

From	Johan Hovold <johan@kernel.org>
Newsgroups	linux.kernel
Subject	[PATCH 3/6] USB: uss720: fix NULL-deref at probe
Date	2017-03-13 13:50 +0100
Message-ID	<tkxAd-ys-5@gated-at.bofh.it> (permalink)
References	<tkxAd-ys-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

Note that the endpoint access that causes the NULL-deref is currently
only used for debugging purposes during probe so the oops only happens
when dynamic debugging is enabled. This means the driver could be
rewritten to continue to accept device with only two endpoints, should
such devices exist.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/usb/misc/uss720.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index e45a3a680db8..07014cad6dbe 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -709,6 +709,11 @@ static int uss720_probe(struct usb_interface *intf,
 
 	interface = intf->cur_altsetting;
 
+	if (interface->desc.bNumEndpoints < 3) {
+		usb_put_dev(usbdev);
+		return -ENODEV;
+	}
+
 	/*
 	 * Allocate parport interface 
 	 */
-- 
2.12.0

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH 3/6] USB: uss720: fix NULL-deref at probe Johan Hovold <johan@kernel.org> - 2017-03-13 13:50 +0100

csiph-web