USB: whiteheat: fix potential null-deref at probe
authorJohan Hovold <johan@kernel.org>
Wed, 23 Sep 2015 18:41:42 +0000 (11:41 -0700)
committerBen Hutchings <ben@decadent.org.uk>
Tue, 13 Oct 2015 02:46:11 +0000 (03:46 +0100)
commitcbea57119272755ccfd710fdaf4669ae05512b02
tree1fe120ea2a33794bd38d2afbd3e9dc408150ed5c
parent307c6c27d5de3b44965cdba2a69e1d5f922a01c1
USB: whiteheat: fix potential null-deref at probe

commit cbb4be652d374f64661137756b8f357a1827d6a4 upstream.

Fix potential null-pointer dereference at probe by making sure that the
required endpoints are present.

The whiteheat driver assumes there are at least five pairs of bulk
endpoints, of which the final pair is used for the "command port". An
attempt to bind to an interface with fewer bulk endpoints would
currently lead to an oops.

Fixes CVE-2015-5257.

Reported-by: Moein Ghasemzadeh <moein@istuary.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/usb/serial/whiteheat.c