| From 4f9785cc99feeb3673993b471f646b4dbaec2cc1 Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Tue, 3 Jan 2017 16:39:44 +0100 |
| Subject: USB: serial: io_ti: fix another NULL-deref at open |
| |
| From: Johan Hovold <johan@kernel.org> |
| |
| commit 4f9785cc99feeb3673993b471f646b4dbaec2cc1 upstream. |
| |
| In case a device is left in "boot-mode" we must not register any port |
| devices in order to avoid a NULL-pointer dereference on open due to |
| missing endpoints. This could be used by a malicious device to trigger |
| an OOPS: |
| |
| Unable to handle kernel NULL pointer dereference at virtual address 00000030 |
| ... |
| [<bf0caa84>] (edge_open [io_ti]) from [<bf0b0118>] (serial_port_activate+0x68/0x98 [usbserial]) |
| [<bf0b0118>] (serial_port_activate [usbserial]) from [<c0470ca4>] (tty_port_open+0x9c/0xe8) |
| [<c0470ca4>] (tty_port_open) from [<bf0b0da0>] (serial_open+0x48/0x6c [usbserial]) |
| [<bf0b0da0>] (serial_open [usbserial]) from [<c0469178>] (tty_open+0xcc/0x5cc) |
| |
| Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/usb/serial/io_ti.c | 9 ++++++--- |
| 1 file changed, 6 insertions(+), 3 deletions(-) |
| |
| --- a/drivers/usb/serial/io_ti.c |
| +++ b/drivers/usb/serial/io_ti.c |
| @@ -1508,7 +1508,7 @@ stayinbootmode: |
| dev_dbg(dev, "%s - STAYING IN BOOT MODE\n", __func__); |
| serial->product_info.TiMode = TI_MODE_BOOT; |
| |
| - return 0; |
| + return 1; |
| } |
| |
| static int ti_do_config(struct edgeport_port *port, int feature, int on) |
| @@ -2563,14 +2563,18 @@ static int edge_startup(struct usb_seria |
| |
| mutex_init(&edge_serial->es_lock); |
| edge_serial->serial = serial; |
| + INIT_DELAYED_WORK(&edge_serial->heartbeat_work, edge_heartbeat_work); |
| usb_set_serial_data(serial, edge_serial); |
| |
| status = download_fw(edge_serial); |
| - if (status) { |
| + if (status < 0) { |
| kfree(edge_serial); |
| return status; |
| } |
| |
| + if (status > 0) |
| + return 1; /* bind but do not register any ports */ |
| + |
| product_id = le16_to_cpu( |
| edge_serial->serial->dev->descriptor.idProduct); |
| |
| @@ -2582,7 +2586,6 @@ static int edge_startup(struct usb_seria |
| } |
| } |
| |
| - INIT_DELAYED_WORK(&edge_serial->heartbeat_work, edge_heartbeat_work); |
| edge_heartbeat_schedule(edge_serial); |
| |
| return 0; |