MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2026-06-25 11:43:20 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

USB: serial: iuu_phoenix: fix NULL-deref at open

Browse Source 
commit 90507d54f7 upstream.

Fix NULL-pointer dereference at open should the device lack a bulk-in or
bulk-out endpoint:

Unable to handle kernel NULL pointer dereference at virtual address 00000030
...
PC is at iuu_open+0x78/0x59c [iuu_phoenix]

Fixes: 07c3b1a100 ("USB: remove broken usb-serial num_endpoints
check")
Signed-off-by: Johan Hovold <johan@kernel.org>
[bwh: Backported to 3.2: add this check to the existing
 usb_serial_driver::attach implementation]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
This commit is contained in:
Johan Hovold 2017-01-03 16:39:47 +01:00 committed by Ben Hutchings
parent 0cfa7d8788
commit a318411d01
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/usb/serial/iuu_phoenix.c
View File

@ -112,7 +112,12 @@ static int iuu_alloc_buf(struct iuu_private *priv)
static int iuu_startup(struct usb_serial *serial)
{
unsigned char num_ports = serial->num_ports;
struct iuu_private *priv;
if (serial->num_bulk_in < num_ports || serial->num_bulk_out < num_ports)
return -ENODEV;
priv = kzalloc(sizeof(struct iuu_private), GFP_KERNEL);
dbg("%s- priv allocation success", __func__);
if (!priv)