summaryrefslogtreecommitdiff
path: root/drivers/usb
diff options
context:
space:
mode:
authorSven Schnelle <svens@stackframe.org>2012-08-17 23:43:43 +0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-08-18 04:55:46 +0400
commit99f347caa4568cb803862730b3b1f1942639523f (patch)
treeeea4cff2cddd658d93beca0a46f31be807b8b3fa /drivers/usb
parent83957df21dd94655d2b026e0944a69ff37b83988 (diff)
downloadlinux-99f347caa4568cb803862730b3b1f1942639523f.tar.xz
USB: CDC ACM: Fix NULL pointer dereference
If a device specifies zero endpoints in its interface descriptor, the kernel oopses in acm_probe(). Even though that's clearly an invalid descriptor, we should test wether we have all endpoints. This is especially bad as this oops can be triggered by just plugging a USB device in. Signed-off-by: Sven Schnelle <svens@stackframe.org> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb')
-rw-r--r--drivers/usb/class/cdc-acm.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 56d6bf668488..f763ed7ba91e 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1104,7 +1104,8 @@ skip_normal_probe:
}
- if (data_interface->cur_altsetting->desc.bNumEndpoints < 2)
+ if (data_interface->cur_altsetting->desc.bNumEndpoints < 2 ||
+ control_interface->cur_altsetting->desc.bNumEndpoints == 0)
return -EINVAL;
epctrl = &control_interface->cur_altsetting->endpoint[0].desc;