[34-longterm 055/260] USB: cdc-acm: Fixing crash when ACM probing interfaces with no endpoint descriptors.

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
From: Paul Gortmaker
Date: Sunday, January 2, 2011 - 12:15 am

From: Toby Gray <toby.gray@realvnc.com>

commit 577045c0a76e34294f902a7d5d60e90b04d094d0 upstream.

Certain USB devices, such as the Nokia X6 mobile phone, don't expose any
endpoint descriptors on some of their interfaces. If the ACM driver is forced
to probe all interfaces on a device the a NULL pointer dereference will occur
when the ACM driver attempts to use the endpoint of the alternative settings.
One way to get the ACM driver to probe all the interfaces is by using the
/sys/bus/usb/drivers/cdc_acm/new_id interface.

This patch checks that the endpoint pointer for the current alternate settings
is non-NULL before using it.

Signed-off-by: Toby Gray <toby.gray@realvnc.com>
Cc: Oliver Neukum <oliver@neukum.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
 drivers/usb/class/cdc-acm.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index ffbf1aa..f1accc8 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -971,7 +971,8 @@ static int acm_probe(struct usb_interface *intf,
 	}
 
 	if (!buflen) {
-		if (intf->cur_altsetting->endpoint->extralen &&
+		if (intf->cur_altsetting->endpoint &&
+				intf->cur_altsetting->endpoint->extralen &&
 				intf->cur_altsetting->endpoint->extra) {
 			dev_dbg(&intf->dev,
 				"Seeking extra descriptors on endpoint\n");
-- 
1.7.3.3

--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:
[34-longterm 000/260] v2.6.34.8 longterm review, Paul Gortmaker, (Sun Jan 2, 12:14 am)
[34-longterm 003/260] ath5k: drop warning on jumbo frames, Paul Gortmaker, (Sun Jan 2, 12:14 am)
[34-longterm 019/260] ext4: Show journal_checksum option, Paul Gortmaker, (Sun Jan 2, 12:15 am)
[34-longterm 025/260] ext4: Fix compat EXT4_IOC_ADD_GROUP, Paul Gortmaker, (Sun Jan 2, 12:15 am)
[34-longterm 028/260] ext4: fix freeze deadlock under IO, Paul Gortmaker, (Sun Jan 2, 12:15 am)
[34-longterm 030/260] xen: handle events as edge-triggered, Paul Gortmaker, (Sun Jan 2, 12:15 am)
[34-longterm 045/260] USB: ehci-ppc-of: problems in unwind, Paul Gortmaker, (Sun Jan 2, 12:15 am)
[34-longterm 047/260] USB: CP210x Add new device ID, Paul Gortmaker, (Sun Jan 2, 12:15 am)
[34-longterm 055/260] USB: cdc-acm: Fixing crash when ACM ..., Paul Gortmaker, (Sun Jan 2, 12:15 am)
[34-longterm 065/260] irda: off by one, Paul Gortmaker, (Sun Jan 2, 12:16 am)
[34-longterm 089/260] sched: Optimize task_rq_lock(), Paul Gortmaker, (Sun Jan 2, 12:16 am)
[34-longterm 090/260] sched: Fix nr_uninterruptible count, Paul Gortmaker, (Sun Jan 2, 12:16 am)
[34-longterm 093/260] sched: Fix select_idle_sibling(), Paul Gortmaker, (Sun Jan 2, 12:16 am)
[34-longterm 098/260] arm: fix really nasty sigreturn bug, Paul Gortmaker, (Sun Jan 2, 12:16 am)
[34-longterm 106/260] drm/i915: Prevent double dpms on, Paul Gortmaker, (Sun Jan 2, 12:16 am)
[34-longterm 110/260] gro: fix different skb headrooms, Paul Gortmaker, (Sun Jan 2, 12:16 am)
[34-longterm 111/260] gro: Re-fix different skb headrooms, Paul Gortmaker, (Sun Jan 2, 12:16 am)
[34-longterm 115/260] tcp: fix three tcp sysctls tuning, Paul Gortmaker, (Sun Jan 2, 12:16 am)
[34-longterm 118/260] rds: fix a leak of kernel memory, Paul Gortmaker, (Sun Jan 2, 12:16 am)
[34-longterm 126/260] Staging: vt6655: fix buffer overflow, Paul Gortmaker, (Sun Jan 2, 12:17 am)
[34-longterm 134/260] percpu: fix pcpu_last_unit_cpu, Paul Gortmaker, (Sun Jan 2, 12:17 am)
[34-longterm 136/260] inotify: send IN_UNMOUNT events, Paul Gortmaker, (Sun Jan 2, 12:17 am)
[34-longterm 139/260] fix siglock, Paul Gortmaker, (Sun Jan 2, 12:17 am)
[34-longterm 145/260] AT91: change dma resource index, Paul Gortmaker, (Sun Jan 2, 12:17 am)
[34-longterm 154/260] inotify: fix inotify oneshot support, Paul Gortmaker, (Sun Jan 2, 12:17 am)
[34-longterm 158/260] alpha: Fix printk format errors, Paul Gortmaker, (Sun Jan 2, 12:17 am)
[34-longterm 188/260] atl1: fix resume, Paul Gortmaker, (Sun Jan 2, 12:18 am)
[34-longterm 190/260] De-pessimize rds_page_copy_user, Paul Gortmaker, (Sun Jan 2, 12:18 am)
[34-longterm 192/260] xfrm4: strip ECN bits from tos field, Paul Gortmaker, (Sun Jan 2, 12:18 am)
[34-longterm 193/260] tcp: Fix &gt;4GB writes on 64-bit., Paul Gortmaker, (Sun Jan 2, 12:18 am)
[34-longterm 199/260] tcp: Fix race in tcp_poll, Paul Gortmaker, (Sun Jan 2, 12:18 am)
[34-longterm 200/260] netxen: dont set skb-&gt;truesize, Paul Gortmaker, (Sun Jan 2, 12:18 am)
[34-longterm 203/260] skge: add quirk to limit DMA, Paul Gortmaker, (Sun Jan 2, 12:18 am)
[34-longterm 208/260] b44: fix carrier detection on bind, Paul Gortmaker, (Sun Jan 2, 12:18 am)
[34-longterm 224/260] bluetooth: Fix missing NULL check, Paul Gortmaker, (Sun Jan 2, 12:18 am)
[34-longterm 236/260] KVM: x86: Fix SVM VMCB reset, Paul Gortmaker, (Sun Jan 2, 12:18 am)
[34-longterm 240/260] p54usb: fix off-by-one on !CONFIG_PM, Paul Gortmaker, (Sun Jan 2, 12:18 am)
[34-longterm 241/260] p54usb: add five more USBIDs, Paul Gortmaker, (Sun Jan 2, 12:18 am)
[34-longterm 256/260] libsas: fix NCQ mixing with non-NCQ, Paul Gortmaker, (Sun Jan 2, 12:19 am)
[34-longterm 257/260] gdth: integer overflow in ioctl, Paul Gortmaker, (Sun Jan 2, 12:19 am)
[34-longterm 258/260] Fix race when removing SCSI devices, Paul Gortmaker, (Sun Jan 2, 12:19 am)
Re: [34-longterm 000/260] v2.6.34.8 longterm review, Paul Gortmaker, (Sun Jan 2, 3:46 am)
Re: [34-longterm 000/260] v2.6.34.8 longterm review, Jiri Slaby, (Mon Jan 3, 3:41 am)
Re: [34-longterm 000/260] v2.6.34.8 longterm review, Paul Gortmaker, (Tue Jan 4, 12:11 pm)