| From: Johan Hovold <johan@kernel.org> |
| Date: Tue, 3 Jan 2017 16:39:44 +0100 |
| Subject: USB: serial: io_ti: fix another NULL-deref at open |
| |
| commit 4f9785cc99feeb3673993b471f646b4dbaec2cc1 upstream. |
| |
| In case a device is left in "boot-mode" we must not register any port |
| devices in order to avoid a NULL-pointer dereference on open due to |
| missing endpoints. This could be used by a malicious device to trigger |
| an OOPS: |
| |
| Unable to handle kernel NULL pointer dereference at virtual address 00000030 |
| ... |
| [<bf0caa84>] (edge_open [io_ti]) from [<bf0b0118>] (serial_port_activate+0x68/0x98 [usbserial]) |
| [<bf0b0118>] (serial_port_activate [usbserial]) from [<c0470ca4>] (tty_port_open+0x9c/0xe8) |
| [<c0470ca4>] (tty_port_open) from [<bf0b0da0>] (serial_open+0x48/0x6c [usbserial]) |
| [<bf0b0da0>] (serial_open [usbserial]) from [<c0469178>] (tty_open+0xcc/0x5cc) |
| |
| Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| [bwh: Backported to 3.16: |
| - No heartbeat_work to initialise earlier |
| - Adjust context] |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/usb/serial/io_ti.c | 9 ++++++--- |
| 1 file changed, 6 insertions(+), 3 deletions(-) |
| |
| --- a/drivers/usb/serial/io_ti.c |
| +++ b/drivers/usb/serial/io_ti.c |
| @@ -1376,7 +1376,7 @@ stayinbootmode: |
| dev_dbg(dev, "%s - STAYING IN BOOT MODE\n", __func__); |
| serial->product_info.TiMode = TI_MODE_BOOT; |
| |
| - return 0; |
| + return 1; |
| } |
| |
| |
| @@ -2400,11 +2400,14 @@ static int edge_startup(struct usb_seria |
| usb_set_serial_data(serial, edge_serial); |
| |
| status = download_fw(edge_serial); |
| - if (status) { |
| + if (status < 0) { |
| kfree(edge_serial); |
| return status; |
| } |
| |
| + if (status > 0) |
| + return 1; /* bind but do not register any ports */ |
| + |
| return 0; |
| } |
| |
