cdc-acm driver expects a notification endpoint and will segfault if there is not

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,
The cdc-acm driver (drivers/usb/class/cdc-acm.c) expects, when the control
interface is different from the data interface, the following things:
* one notification endpoint in control interface
* two data endpoints (bulk/iso) in data interface

The problem is that the first requirement is not in the spec as far as I
understand it (it's optional). Furthermore, the driver doesn't check if there
actually is an endpoint but makes a pointer from it:

epctrl = &control_interface->cur_altsetting->endpoint[0].desc;

If there is no notification endpoint, this will result in a NULL pointer
dereference. Notice that there are two problems out there:
* it should do the check anyway, for safety reason
* it shouldn't assume an endpoint if the spec doesn't require it (but I'm
unsure about this point)

I submitted a bug report to the Kernel Bug Tracker (Bug 18322) but was
then redirected to this mailing list for further discussion.
Regards

Amaury Pouly
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux