Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a5bc0194 authored by Johan Hovold's avatar Johan Hovold
Browse files

USB: serial: omninet: fix NULL-derefs at open and disconnect 



Fix NULL-pointer dereferences at open() and disconnect() should the
device lack the expected bulk-out endpoints:

Unable to handle kernel NULL pointer dereference at virtual address 000000b4
...
[c0170ff0>] (__lock_acquire) from [<c0172f00>] (lock_acquire+0x108/0x264)
[<c0172f00>] (lock_acquire) from [<c06a5090>] (_raw_spin_lock_irqsave+0x58/0x6c)
[<c06a5090>] (_raw_spin_lock_irqsave) from [<c0470684>] (tty_port_tty_set+0x28/0xa4)
[<c0470684>] (tty_port_tty_set) from [<bf08d384>] (omninet_open+0x30/0x40 [omninet])
[<bf08d384>] (omninet_open [omninet]) from [<bf07c118>] (serial_port_activate+0x68/0x98 [usbserial])

Unable to handle kernel NULL pointer dereference at virtual address 00000234
...
[<bf01f418>] (omninet_disconnect [omninet]) from [<bf0016c0>] (usb_serial_disconnect+0xe4/0x100 [usbserial])

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
parent 472d7e55

drivers/usb/serial/omninet.c

+13 −0
Original line number Diff line number Diff line
@@ -38,6 +38,7 @@ static int omninet_write(struct tty_struct *tty, struct usb_serial_port *port, 
				const unsigned char *buf, int count);

static int  omninet_write_room(struct tty_struct *tty);

static void omninet_disconnect(struct usb_serial *serial);

static int omninet_attach(struct usb_serial *serial);

static int omninet_port_probe(struct usb_serial_port *port);

static int omninet_port_remove(struct usb_serial_port *port);
@@ -56,6 +57,7 @@ static struct usb_serial_driver zyxel_omninet_device = { 
	.description =		"ZyXEL - omni.net lcd plus usb",

	.id_table =		id_table,

	.num_ports =		1,

	.attach =		omninet_attach,

	.port_probe =		omninet_port_probe,

	.port_remove =		omninet_port_remove,

	.open =			omninet_open,
@@ -104,6 +106,17 @@ struct omninet_data { 
	__u8	od_outseq;	/* Sequence number for bulk_out URBs */

};



static int omninet_attach(struct usb_serial *serial)

{

	/* The second bulk-out endpoint is used for writing. */

	if (serial->num_bulk_out < 2) {

		dev_err(&serial->interface->dev, "missing endpoints\n");

		return -ENODEV;

	}



	return 0;

}



static int omninet_port_probe(struct usb_serial_port *port)

{

	struct omninet_data *od;