Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e58547eb authored by Krzysztof Mazur's avatar Krzysztof Mazur Committed by Greg Kroah-Hartman
Browse files

usb: fail on usb_hub_create_port_device() errors 



Ignoring usb_hub_create_port_device() errors cause later NULL pointer
deference when uninitialized hub->ports[i] entries are dereferenced
after port memory allocation error.

Signed-off-by: default avatarKrzysztof Mazur <krzysiek@podlesie.net>
Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d0308d4b

drivers/usb/core/hub.c

+8 −2
Original line number Diff line number Diff line
@@ -1562,10 +1562,15 @@ static int hub_configure(struct usb_hub *hub, 
	if (hub->has_indicators && blinkenlights)

		hub->indicator [0] = INDICATOR_CYCLE;



	for (i = 0; i < hdev->maxchild; i++)

		if (usb_hub_create_port_device(hub, i + 1) < 0)

	for (i = 0; i < hdev->maxchild; i++) {

		ret = usb_hub_create_port_device(hub, i + 1);

		if (ret < 0) {

			dev_err(hub->intfdev,

				"couldn't create port%d device.\n", i + 1);

			hdev->maxchild = i;

			goto fail_keep_maxchild;

		}

	}



	usb_hub_adjust_deviceremovable(hdev, hub->descriptor);
@@ -1574,6 +1579,7 @@ static int hub_configure(struct usb_hub *hub, 


fail:

	hdev->maxchild = 0;

fail_keep_maxchild:

	dev_err (hub_dev, "config failed, %s (err %d)\n",

			message, ret);

	/* hub_disconnect() frees urb and descriptor */