Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 76ab439e authored by Johan Hovold's avatar Johan Hovold
Browse files

USB: serial: pl2303: fix NULL-deref at open 



Fix NULL-pointer dereference in open() should a type-0 or type-1 device
lack the expected endpoints:

Unable to handle kernel NULL pointer dereference at virtual address 00000030
...
PC is at pl2303_open+0x38/0xec [pl2303]

Note that a missing interrupt-in endpoint would have caused open() to
fail.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
parent 5afeef23

drivers/usb/serial/pl2303.c

+8 −0
Original line number Diff line number Diff line
@@ -220,9 +220,17 @@ static int pl2303_probe(struct usb_serial *serial, 
static int pl2303_startup(struct usb_serial *serial)

{

	struct pl2303_serial_private *spriv;

	unsigned char num_ports = serial->num_ports;

	enum pl2303_type type = TYPE_01;

	unsigned char *buf;



	if (serial->num_bulk_in < num_ports ||

			serial->num_bulk_out < num_ports ||

			serial->num_interrupt_in < num_ports) {

		dev_err(&serial->interface->dev, "missing endpoints\n");

		return -ENODEV;

	}



	spriv = kzalloc(sizeof(*spriv), GFP_KERNEL);

	if (!spriv)

		return -ENOMEM;