Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2ae4605d authored by Karsten Keil's avatar Karsten Keil Committed by David S. Miller
Browse files

ISDN: Add check for usb_alloc_urb() result 



usb_alloc_urb() return value needs to be checked to avoid
later NULL pointer access.
Reported by rucsoftsec@gmail.com via bugzilla.kernel.org #44601.

Signed-off-by: default avatarKarsten Keil <kkeil@linux-pingi.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5b999fd0

drivers/isdn/hardware/mISDN/hfcsusb.c

+13 −5
Original line number Diff line number Diff line
@@ -2084,11 +2084,19 @@ hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id) 
	/* create the control pipes needed for register access */

	hw->ctrl_in_pipe = usb_rcvctrlpipe(hw->dev, 0);

	hw->ctrl_out_pipe = usb_sndctrlpipe(hw->dev, 0);



	driver_info = (struct hfcsusb_vdata *)

		      hfcsusb_idtab[vend_idx].driver_info;



	hw->ctrl_urb = usb_alloc_urb(0, GFP_KERNEL);

	if (!hw->ctrl_urb) {

		pr_warn("%s: No memory for control urb\n",

			driver_info->vend_name);

		kfree(hw);

		return -ENOMEM;

	}



	driver_info =

		(struct hfcsusb_vdata *)hfcsusb_idtab[vend_idx].driver_info;

	printk(KERN_DEBUG "%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n",

	pr_info("%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n",

		hw->name, __func__, driver_info->vend_name,

		conf_str[small_match], ifnum, alt_used);

drivers/isdn/hisax/hfc_usb.c

+13 −5
Original line number Diff line number Diff line
@@ -1483,12 +1483,20 @@ hfc_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) 
				usb_rcvctrlpipe(context->dev, 0);

			context->ctrl_out_pipe =

				usb_sndctrlpipe(context->dev, 0);



			driver_info = (hfcsusb_vdata *)

				      hfcusb_idtab[vend_idx].driver_info;



			context->ctrl_urb = usb_alloc_urb(0, GFP_KERNEL);



			driver_info =

				(hfcsusb_vdata *) hfcusb_idtab[vend_idx].

				driver_info;

			printk(KERN_INFO "HFC-S USB: detected \"%s\"\n",

			if (!context->ctrl_urb) {

				pr_warn("%s: No memory for control urb\n",

					driver_info->vend_name);

				kfree(context);

				return -ENOMEM;

			}



			pr_info("HFC-S USB: detected \"%s\"\n",

				driver_info->vend_name);



			DBG(HFCUSB_DBG_INIT,