* [PATCH net] hso: fix NULL-deref on tty open
@ 2019-09-30 15:12 Johan Hovold
2019-10-02 1:08 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Johan Hovold @ 2019-09-30 15:12 UTC (permalink / raw)
To: David S. Miller; +Cc: linux-usb, netdev, linux-kernel, Johan Hovold
Fix NULL-pointer dereference on tty open due to a failure to handle a
missing interrupt-in endpoint when probing modem ports:
BUG: kernel NULL pointer dereference, address: 0000000000000006
...
RIP: 0010:tiocmget_submit_urb+0x1c/0xe0 [hso]
...
Call Trace:
hso_start_serial_device+0xdc/0x140 [hso]
hso_serial_open+0x118/0x1b0 [hso]
tty_open+0xf1/0x490
Fixes: 542f54823614 ("tty: Modem functions for the HSO driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/net/usb/hso.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index ce78714f536f..a505b2ab88b8 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2620,14 +2620,18 @@ static struct hso_device *hso_create_bulk_serial_device(
*/
if (serial->tiocmget) {
tiocmget = serial->tiocmget;
+ tiocmget->endp = hso_get_ep(interface,
+ USB_ENDPOINT_XFER_INT,
+ USB_DIR_IN);
+ if (!tiocmget->endp) {
+ dev_err(&interface->dev, "Failed to find INT IN ep\n");
+ goto exit;
+ }
+
tiocmget->urb = usb_alloc_urb(0, GFP_KERNEL);
if (tiocmget->urb) {
mutex_init(&tiocmget->mutex);
init_waitqueue_head(&tiocmget->waitq);
- tiocmget->endp = hso_get_ep(
- interface,
- USB_ENDPOINT_XFER_INT,
- USB_DIR_IN);
} else
hso_free_tiomget(serial);
}
--
2.23.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] hso: fix NULL-deref on tty open
2019-09-30 15:12 [PATCH net] hso: fix NULL-deref on tty open Johan Hovold
@ 2019-10-02 1:08 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2019-10-02 1:08 UTC (permalink / raw)
To: johan; +Cc: linux-usb, netdev, linux-kernel
From: Johan Hovold <johan@kernel.org>
Date: Mon, 30 Sep 2019 17:12:41 +0200
> Fix NULL-pointer dereference on tty open due to a failure to handle a
> missing interrupt-in endpoint when probing modem ports:
>
> BUG: kernel NULL pointer dereference, address: 0000000000000006
> ...
> RIP: 0010:tiocmget_submit_urb+0x1c/0xe0 [hso]
> ...
> Call Trace:
> hso_start_serial_device+0xdc/0x140 [hso]
> hso_serial_open+0x118/0x1b0 [hso]
> tty_open+0xf1/0x490
>
> Fixes: 542f54823614 ("tty: Modem functions for the HSO driver")
> Signed-off-by: Johan Hovold <johan@kernel.org>
Applied, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-10-02 1:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-30 15:12 [PATCH net] hso: fix NULL-deref on tty open Johan Hovold
2019-10-02 1:08 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).