| Message ID | 20190930151241.25646-1-johan@kernel.org (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 8353da9fa69722b54cba82b2ec740afd3d438748 |
| Headers | show |
| Series | [net] hso: fix NULL-deref on tty open | expand |
From: Johan Hovold <johan@kernel.org> Date: Mon, 30 Sep 2019 17:12:41 +0200 > Fix NULL-pointer dereference on tty open due to a failure to handle a > missing interrupt-in endpoint when probing modem ports: > > BUG: kernel NULL pointer dereference, address: 0000000000000006 > ... > RIP: 0010:tiocmget_submit_urb+0x1c/0xe0 [hso] > ... > Call Trace: > hso_start_serial_device+0xdc/0x140 [hso] > hso_serial_open+0x118/0x1b0 [hso] > tty_open+0xf1/0x490 > > Fixes: 542f54823614 ("tty: Modem functions for the HSO driver") > Signed-off-by: Johan Hovold <johan@kernel.org> Applied, thanks.
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c index ce78714f536f..a505b2ab88b8 100644 --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -2620,14 +2620,18 @@ static struct hso_device *hso_create_bulk_serial_device( */ if (serial->tiocmget) { tiocmget = serial->tiocmget; + tiocmget->endp = hso_get_ep(interface, + USB_ENDPOINT_XFER_INT, + USB_DIR_IN); + if (!tiocmget->endp) { + dev_err(&interface->dev, "Failed to find INT IN ep\n"); + goto exit; + } + tiocmget->urb = usb_alloc_urb(0, GFP_KERNEL); if (tiocmget->urb) { mutex_init(&tiocmget->mutex); init_waitqueue_head(&tiocmget->waitq); - tiocmget->endp = hso_get_ep( - interface, - USB_ENDPOINT_XFER_INT, - USB_DIR_IN); } else hso_free_tiomget(serial); }
Fix NULL-pointer dereference on tty open due to a failure to handle a missing interrupt-in endpoint when probing modem ports: BUG: kernel NULL pointer dereference, address: 0000000000000006 ... RIP: 0010:tiocmget_submit_urb+0x1c/0xe0 [hso] ... Call Trace: hso_start_serial_device+0xdc/0x140 [hso] hso_serial_open+0x118/0x1b0 [hso] tty_open+0xf1/0x490 Fixes: 542f54823614 ("tty: Modem functions for the HSO driver") Signed-off-by: Johan Hovold <johan@kernel.org> --- drivers/net/usb/hso.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)