Commit a5bc0194 authored by Johan Hovold's avatar Johan Hovold

USB: serial: omninet: fix NULL-derefs at open and disconnect

Fix NULL-pointer dereferences at open() and disconnect() should the
device lack the expected bulk-out endpoints:

Unable to handle kernel NULL pointer dereference at virtual address 000000b4
...
[c0170ff0>] (__lock_acquire) from [<c0172f00>] (lock_acquire+0x108/0x264)
[<c0172f00>] (lock_acquire) from [<c06a5090>] (_raw_spin_lock_irqsave+0x58/0x6c)
[<c06a5090>] (_raw_spin_lock_irqsave) from [<c0470684>] (tty_port_tty_set+0x28/0xa4)
[<c0470684>] (tty_port_tty_set) from [<bf08d384>] (omninet_open+0x30/0x40 [omninet])
[<bf08d384>] (omninet_open [omninet]) from [<bf07c118>] (serial_port_activate+0x68/0x98 [usbserial])

Unable to handle kernel NULL pointer dereference at virtual address 00000234
...
[<bf01f418>] (omninet_disconnect [omninet]) from [<bf0016c0>] (usb_serial_disconnect+0xe4/0x100 [usbserial])

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
parent 472d7e55
...@@ -38,6 +38,7 @@ static int omninet_write(struct tty_struct *tty, struct usb_serial_port *port, ...@@ -38,6 +38,7 @@ static int omninet_write(struct tty_struct *tty, struct usb_serial_port *port,
const unsigned char *buf, int count); const unsigned char *buf, int count);
static int omninet_write_room(struct tty_struct *tty); static int omninet_write_room(struct tty_struct *tty);
static void omninet_disconnect(struct usb_serial *serial); static void omninet_disconnect(struct usb_serial *serial);
static int omninet_attach(struct usb_serial *serial);
static int omninet_port_probe(struct usb_serial_port *port); static int omninet_port_probe(struct usb_serial_port *port);
static int omninet_port_remove(struct usb_serial_port *port); static int omninet_port_remove(struct usb_serial_port *port);
...@@ -56,6 +57,7 @@ static struct usb_serial_driver zyxel_omninet_device = { ...@@ -56,6 +57,7 @@ static struct usb_serial_driver zyxel_omninet_device = {
.description = "ZyXEL - omni.net lcd plus usb", .description = "ZyXEL - omni.net lcd plus usb",
.id_table = id_table, .id_table = id_table,
.num_ports = 1, .num_ports = 1,
.attach = omninet_attach,
.port_probe = omninet_port_probe, .port_probe = omninet_port_probe,
.port_remove = omninet_port_remove, .port_remove = omninet_port_remove,
.open = omninet_open, .open = omninet_open,
...@@ -104,6 +106,17 @@ struct omninet_data { ...@@ -104,6 +106,17 @@ struct omninet_data {
__u8 od_outseq; /* Sequence number for bulk_out URBs */ __u8 od_outseq; /* Sequence number for bulk_out URBs */
}; };
static int omninet_attach(struct usb_serial *serial)
{
/* The second bulk-out endpoint is used for writing. */
if (serial->num_bulk_out < 2) {
dev_err(&serial->interface->dev, "missing endpoints\n");
return -ENODEV;
}
return 0;
}
static int omninet_port_probe(struct usb_serial_port *port) static int omninet_port_probe(struct usb_serial_port *port)
{ {
struct omninet_data *od; struct omninet_data *od;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment