Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2fdc9b35 authored by Badhri Jagan Sridharan's avatar Badhri Jagan Sridharan Committed by Dmitry Shmidt
Browse files

UPSTREAM: USB: cypress_m8: add endpoint sanity check 



commit c55aee1bf0e6b6feec8b2927b43f7a09a6d5f754 upstream.

An attack using missing endpoints exists.

CVE-2016-3137

BUG: 28242610
Signed-off-by: default avatarOliver Neukum <ONeukum@suse.com>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarBadhri Jagan Sridharan <Badhri@google.com>
Change-Id: I1cc7957a5924175d24f12fdc41162ece67c907e5
(cherry picked from commit ceab5ff78a8d897939a2c073909980f3dc27ea5e)
parent 2a05ccfe

drivers/usb/serial/cypress_m8.c

+5 −6
Original line number Diff line number Diff line
@@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port) 
	struct usb_serial *serial = port->serial;

	struct cypress_private *priv;



	if (!port->interrupt_out_urb || !port->interrupt_in_urb) {

		dev_err(&port->dev, "required endpoint is missing\n");

		return -ENODEV;

	}



	priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL);

	if (!priv)

		return -ENOMEM;
@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port) 
		cypress_set_termios(tty, port, &priv->tmp_termios);



	/* setup the port and start reading from the device */

	if (!port->interrupt_in_urb) {

		dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n",

			__func__);

		return -1;

	}



	usb_fill_int_urb(port->interrupt_in_urb, serial->dev,

		usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress),

		port->interrupt_in_urb->transfer_buffer,