lkml.org 
[lkml]   [2014]   [Jul]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 072/170] USB: ftdi_sio: fix null deref at port probe
    Date
    From: Johan Hovold <johan@kernel.org>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    commit aea1ae8760314e072bf1b773521e9de5d5dda10d upstream.

    Fix NULL-pointer dereference when probing an interface with no
    endpoints.

    These devices have two bulk endpoints per interface, but this avoids
    crashing the kernel if a user forces a non-FTDI device to be probed.

    Note that the iterator variable was made unsigned in order to avoid
    a maybe-uninitialized compiler warning for ep_desc after the loop.

    Fixes: 895f28badce9 ("USB: ftdi_sio: fix hi-speed device packet size
    calculation")

    Reported-by: Mike Remski <mremski@mutualink.net>
    Tested-by: Mike Remski <mremski@mutualink.net>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    drivers/usb/serial/ftdi_sio.c | 7 +++++--
    1 file changed, 5 insertions(+), 2 deletions(-)

    diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    index 503c89e18187..ebf04c7d49cb 100644
    --- a/drivers/usb/serial/ftdi_sio.c
    +++ b/drivers/usb/serial/ftdi_sio.c
    @@ -1567,14 +1567,17 @@ static void ftdi_set_max_packet_size(struct usb_serial_port *port)
    struct usb_device *udev = serial->dev;

    struct usb_interface *interface = serial->interface;
    - struct usb_endpoint_descriptor *ep_desc = &interface->cur_altsetting->endpoint[1].desc;
    + struct usb_endpoint_descriptor *ep_desc;

    unsigned num_endpoints;
    - int i;
    + unsigned i;

    num_endpoints = interface->cur_altsetting->desc.bNumEndpoints;
    dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints);

    + if (!num_endpoints)
    + return;
    +
    /* NOTE: some customers have programmed FT232R/FT245R devices
    * with an endpoint size of 0 - not good. In this case, we
    * want to override the endpoint descriptor setting and use a
    --
    2.0.0


    \
     
     \ /
      Last update: 2014-07-18 16:01    [W:4.036 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site