Skip to content

Commit

Permalink
USB: atm: ueagle-atm: add missing endpoint check
Browse files Browse the repository at this point in the history
Make sure that the interrupt interface has an endpoint before trying to
access its endpoint descriptors to avoid dereferencing a NULL pointer.

The driver binds to the interrupt interface with interface number 0, but
must not assume that this interface or its current alternate setting are
the first entries in the corresponding configuration arrays.

Fixes: b72458a ("[PATCH] USB: Eagle and ADI 930 usb adsl modem driver")
Cc: stable <stable@vger.kernel.org>     # 2.6.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191210112601.3561-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Johan Hovold authored and Greg Kroah-Hartman committed Dec 10, 2019
1 parent 3c11c4b commit 09068c1
Showing 1 changed file with 12 additions and 6 deletions.
18 changes: 12 additions & 6 deletions drivers/usb/atm/ueagle-atm.c
Original file line number Diff line number Diff line change
Expand Up @@ -2124,10 +2124,11 @@ static void uea_intr(struct urb *urb)
/*
* Start the modem : init the data and start kernel thread
*/
static int uea_boot(struct uea_softc *sc)
static int uea_boot(struct uea_softc *sc, struct usb_interface *intf)
{
int ret, size;
struct intr_pkt *intr;
int ret = -ENOMEM;
int size;

uea_enters(INS_TO_USBDEV(sc));

Expand All @@ -2152,6 +2153,11 @@ static int uea_boot(struct uea_softc *sc)
if (UEA_CHIP_VERSION(sc) == ADI930)
load_XILINX_firmware(sc);

if (intf->cur_altsetting->desc.bNumEndpoints < 1) {
ret = -ENODEV;
goto err0;
}

intr = kmalloc(size, GFP_KERNEL);
if (!intr)
goto err0;
Expand All @@ -2163,8 +2169,7 @@ static int uea_boot(struct uea_softc *sc)
usb_fill_int_urb(sc->urb_int, sc->usb_dev,
usb_rcvintpipe(sc->usb_dev, UEA_INTR_PIPE),
intr, size, uea_intr, sc,
sc->usb_dev->actconfig->interface[0]->altsetting[0].
endpoint[0].desc.bInterval);
intf->cur_altsetting->endpoint[0].desc.bInterval);

ret = usb_submit_urb(sc->urb_int, GFP_KERNEL);
if (ret < 0) {
Expand All @@ -2179,6 +2184,7 @@ static int uea_boot(struct uea_softc *sc)
sc->kthread = kthread_create(uea_kthread, sc, "ueagle-atm");
if (IS_ERR(sc->kthread)) {
uea_err(INS_TO_USBDEV(sc), "failed to create thread\n");
ret = PTR_ERR(sc->kthread);
goto err2;
}

Expand All @@ -2193,7 +2199,7 @@ static int uea_boot(struct uea_softc *sc)
kfree(intr);
err0:
uea_leaves(INS_TO_USBDEV(sc));
return -ENOMEM;
return ret;
}

/*
Expand Down Expand Up @@ -2548,7 +2554,7 @@ static int uea_bind(struct usbatm_data *usbatm, struct usb_interface *intf,
}
}

ret = uea_boot(sc);
ret = uea_boot(sc, intf);
if (ret < 0)
goto error;

Expand Down

0 comments on commit 09068c1

Please sign in to comment.