| From: Sven Schnelle <svens@stackframe.org> |
| Date: Fri, 17 Aug 2012 21:43:43 +0200 |
| Subject: USB: CDC ACM: Fix NULL pointer dereference |
| |
| commit 99f347caa4568cb803862730b3b1f1942639523f upstream. |
| |
| If a device specifies zero endpoints in its interface descriptor, |
| the kernel oopses in acm_probe(). Even though that's clearly an |
| invalid descriptor, we should test wether we have all endpoints. |
| This is especially bad as this oops can be triggered by just |
| plugging a USB device in. |
| |
| Signed-off-by: Sven Schnelle <svens@stackframe.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/usb/class/cdc-acm.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c |
| index 56d6bf6..f763ed7 100644 |
| --- a/drivers/usb/class/cdc-acm.c |
| +++ b/drivers/usb/class/cdc-acm.c |
| @@ -1104,7 +1104,8 @@ skip_normal_probe: |
| } |
| |
| |
| - if (data_interface->cur_altsetting->desc.bNumEndpoints < 2) |
| + if (data_interface->cur_altsetting->desc.bNumEndpoints < 2 || |
| + control_interface->cur_altsetting->desc.bNumEndpoints == 0) |
| return -EINVAL; |
| |
| epctrl = &control_interface->cur_altsetting->endpoint[0].desc; |
