summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSven Schnelle <svens@stackframe.org>2012-08-17 21:43:43 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-09-14 10:00:22 -0700
commita9959bb7e1510edb3326beb354e59da0a6a0dab1 (patch)
tree18857cd073bb4010495b9353d064f9de0ad52057
parent5750abb9208ee301f0ae9c6c6cb231460feddf0e (diff)
downloadlinux-3.10-a9959bb7e1510edb3326beb354e59da0a6a0dab1.tar.gz
linux-3.10-a9959bb7e1510edb3326beb354e59da0a6a0dab1.tar.bz2
linux-3.10-a9959bb7e1510edb3326beb354e59da0a6a0dab1.zip
USB: CDC ACM: Fix NULL pointer dereference
commit 99f347caa4568cb803862730b3b1f1942639523f upstream. If a device specifies zero endpoints in its interface descriptor, the kernel oopses in acm_probe(). Even though that's clearly an invalid descriptor, we should test wether we have all endpoints. This is especially bad as this oops can be triggered by just plugging a USB device in. Signed-off-by: Sven Schnelle <svens@stackframe.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/usb/class/cdc-acm.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 640cf7983b0..1b632cb88ac 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1104,7 +1104,8 @@ skip_normal_probe:
}
- if (data_interface->cur_altsetting->desc.bNumEndpoints < 2)
+ if (data_interface->cur_altsetting->desc.bNumEndpoints < 2 ||
+ control_interface->cur_altsetting->desc.bNumEndpoints == 0)
return -EINVAL;
epctrl = &control_interface->cur_altsetting->endpoint[0].desc;