This is a note to let you know that I've just added the patch titled
USB: serial: mos7840: fix another NULL-deref at open
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-serial-mos7840-fix-another-null-deref-at-open.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 5182c2cf2a9bfb7f066ef0bdd2bb6330b94dd74e Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@xxxxxxxxxx>
Date: Thu, 9 Feb 2017 12:11:41 +0100
Subject: USB: serial: mos7840: fix another NULL-deref at open
From: Johan Hovold <johan@xxxxxxxxxx>
commit 5182c2cf2a9bfb7f066ef0bdd2bb6330b94dd74e upstream.
Fix another NULL-pointer dereference at open should a malicious device
lack an interrupt-in endpoint.
Note that the driver has a broken check for an interrupt-in endpoint
which means that an interrupt URB has never even been submitted.
Fixes: 3f5429746d91 ("USB: Moschip 7840 USB-Serial Driver")
Reviewed-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Johan Hovold <johan@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/usb/serial/mos7840.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1024,6 +1024,7 @@ static int mos7840_open(struct tty_struc
* (can't set it up in mos7840_startup as the structures *
* were not set up at that time.) */
if (port0->open_ports == 1) {
+ /* FIXME: Buffer never NULL, so URB is not submitted. */
if (serial->port[0]->interrupt_in_buffer == NULL) {
/* set up interrupt urb */
usb_fill_int_urb(serial->port[0]->interrupt_in_urb,
@@ -2119,7 +2120,8 @@ static int mos7840_calc_num_ports(struct
static int mos7840_attach(struct usb_serial *serial)
{
if (serial->num_bulk_in < serial->num_ports ||
- serial->num_bulk_out < serial->num_ports) {
+ serial->num_bulk_out < serial->num_ports ||
+ serial->num_interrupt_in < 1) {
dev_err(&serial->interface->dev, "missing endpoints\n");
return -ENODEV;
}
Patches currently in stable-queue which might be from johan@xxxxxxxxxx are
queue-4.9/usb-serial-ftdi_sio-fix-modem-status-error-handling.patch
queue-4.9/usb-serial-cp210x-add-new-ids-for-ge-bx50v3-boards.patch
queue-4.9/usb-serial-ark3116-fix-register-accessor-error-handling.patch
queue-4.9/usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch
queue-4.9/usb-serial-ftdi_sio-fix-line-status-over-reporting.patch
queue-4.9/usb-serial-ftdi_sio-fix-extreme-low-latency-setting.patch
queue-4.9/usb-serial-spcp8x5-fix-modem-status-handling.patch
queue-4.9/usb-serial-opticon-fix-cts-retrieval-at-open.patch
queue-4.9/usb-serial-mos7840-fix-another-null-deref-at-open.patch
queue-4.9/usb-serial-console-fix-uninitialised-spinlock.patch