Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit de46e566 authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman
Browse files

USB: iowarrior: fix NULL-deref in write 



Make sure to verify that we have the required interrupt-out endpoint for
IOWarrior56 devices to avoid dereferencing a NULL-pointer in write
should a malicious device lack such an endpoint.

Fixes: 946b960d ("USB: add driver for iowarrior devices.")
Cc: stable <stable@vger.kernel.org>     # 2.6.21
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b7321e81

drivers/usb/misc/iowarrior.c

+8 −0
Original line number Diff line number Diff line
@@ -798,6 +798,14 @@ static int iowarrior_probe(struct usb_interface *interface, 
		goto error;

	}



	if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) {

		if (!dev->int_out_endpoint) {

			dev_err(&interface->dev, "no interrupt-out endpoint found\n");

			retval = -ENODEV;

			goto error;

		}

	}



	/* we have to check the report_size often, so remember it in the endianness suitable for our machine */

	dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint);

	if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) &&