Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5afeef23 authored by Johan Hovold's avatar Johan Hovold
Browse files

USB: serial: oti6858: fix NULL-deref at open 



Fix NULL-pointer dereference in open() should the device lack the
expected endpoints:

Unable to handle kernel NULL pointer dereference at virtual address 00000030
...
PC is at oti6858_open+0x30/0x1d0 [oti6858]

Note that a missing interrupt-in endpoint would have caused open() to
fail.

Fixes: 49cdee0e ("USB: oti6858 usb-serial driver (in Nokia CA-42
cable)")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
parent a5bc0194

drivers/usb/serial/oti6858.c

+16 −0
Original line number Diff line number Diff line
@@ -134,6 +134,7 @@ static int oti6858_chars_in_buffer(struct tty_struct *tty); 
static int oti6858_tiocmget(struct tty_struct *tty);

static int oti6858_tiocmset(struct tty_struct *tty,

				unsigned int set, unsigned int clear);

static int oti6858_attach(struct usb_serial *serial);

static int oti6858_port_probe(struct usb_serial_port *port);

static int oti6858_port_remove(struct usb_serial_port *port);
@@ -158,6 +159,7 @@ static struct usb_serial_driver oti6858_device = { 
	.write_bulk_callback =	oti6858_write_bulk_callback,

	.write_room =		oti6858_write_room,

	.chars_in_buffer =	oti6858_chars_in_buffer,

	.attach =		oti6858_attach,

	.port_probe =		oti6858_port_probe,

	.port_remove =		oti6858_port_remove,

};
@@ -324,6 +326,20 @@ static void send_data(struct work_struct *work) 
	usb_serial_port_softint(port);

}



static int oti6858_attach(struct usb_serial *serial)

{

	unsigned char num_ports = serial->num_ports;



	if (serial->num_bulk_in < num_ports ||

			serial->num_bulk_out < num_ports ||

			serial->num_interrupt_in < num_ports) {

		dev_err(&serial->interface->dev, "missing endpoints\n");

		return -ENODEV;

	}



	return 0;

}



static int oti6858_port_probe(struct usb_serial_port *port)

{

	struct oti6858_private *priv;