| From f1c030719986e502ebf7744ee127d0b7a4744d65 Mon Sep 17 00:00:00 2001 |
| From: Sven Schnelle <svens@stackframe.org> |
| Date: Fri, 17 Aug 2012 21:43:43 +0200 |
| Subject: [PATCH] USB: CDC ACM: Fix NULL pointer dereference |
| |
| commit 99f347caa4568cb803862730b3b1f1942639523f upstream. |
| |
| If a device specifies zero endpoints in its interface descriptor, |
| the kernel oopses in acm_probe(). Even though that's clearly an |
| invalid descriptor, we should test wether we have all endpoints. |
| This is especially bad as this oops can be triggered by just |
| plugging a USB device in. |
| |
| Signed-off-by: Sven Schnelle <svens@stackframe.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| --- |
| drivers/usb/class/cdc-acm.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c |
| index af45f735f6e5..45f85df306e5 100644 |
| --- a/drivers/usb/class/cdc-acm.c |
| +++ b/drivers/usb/class/cdc-acm.c |
| @@ -1120,7 +1120,8 @@ skip_normal_probe: |
| } |
| |
| |
| - if (data_interface->cur_altsetting->desc.bNumEndpoints < 2) |
| + if (data_interface->cur_altsetting->desc.bNumEndpoints < 2 || |
| + control_interface->cur_altsetting->desc.bNumEndpoints == 0) |
| return -EINVAL; |
| |
| epctrl = &control_interface->cur_altsetting->endpoint[0].desc; |
| -- |
| 1.8.5.2 |
| |
