Skip to content

Commit

Permalink
USB: serial: ti_usb_3410_5052: fix NULL-deref at open
Browse files Browse the repository at this point in the history
Fix NULL-pointer dereference in open() should a malicious device lack
the expected endpoints:

Unable to handle kernel NULL pointer dereference at virtual address 00000030
..
[<bf06a6b0>] (ti_open [ti_usb_3410_5052]) from [<bf02e118>] (serial_port_activate+0x68/0x98 [usbserial])

Fixes: 1da177e ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
  • Loading branch information
Johan Hovold committed Jan 4, 2017
1 parent cc09092 commit ef07993
Showing 1 changed file with 7 additions and 0 deletions.
7 changes: 7 additions & 0 deletions drivers/usb/serial/ti_usb_3410_5052.c
Original file line number Diff line number Diff line change
Expand Up @@ -579,6 +579,13 @@ static int ti_startup(struct usb_serial *serial)
goto free_tdev;
}

if (serial->num_bulk_in < serial->num_ports ||
serial->num_bulk_out < serial->num_ports) {
dev_err(&serial->interface->dev, "missing endpoints\n");
status = -ENODEV;
goto free_tdev;
}

return 0;

free_tdev:
Expand Down

0 comments on commit ef07993

Please sign in to comment.