Commit f259ca3e authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman

USB: uss720: fix NULL-deref at probe

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

Note that the endpoint access that causes the NULL-deref is currently
only used for debugging purposes during probe so the oops only happens
when dynamic debugging is enabled. This means the driver could be
rewritten to continue to accept device with only two endpoints, should
such devices exist.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 1dc56c52
...@@ -709,6 +709,11 @@ static int uss720_probe(struct usb_interface *intf, ...@@ -709,6 +709,11 @@ static int uss720_probe(struct usb_interface *intf,
interface = intf->cur_altsetting; interface = intf->cur_altsetting;
if (interface->desc.bNumEndpoints < 3) {
usb_put_dev(usbdev);
return -ENODEV;
}
/* /*
* Allocate parport interface * Allocate parport interface
*/ */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment