USB: serial: mos7720: fix use-after-free on probe errors

[pandora-kernel.git] / drivers / usb / serial / mos7720.c

diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index e3609b8..eadeee5 100644 (file)
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -2079,6 +2079,11 @@ static int mos7720_startup(struct usb_serial *serial)
                return -ENODEV;
        }
 
+       if (serial->num_bulk_in < 2 || serial->num_bulk_out < 2) {
+               dev_err(&serial->interface->dev, "missing bulk endpoints\n");
+               return -ENODEV;
+       }
+
        product = le16_to_cpu(serial->dev->descriptor.idProduct);
        dev = serial->dev;
 
@@ -2142,8 +2147,10 @@ static int mos7720_startup(struct usb_serial *serial)
 #ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT
        if (product == MOSCHIP_DEVICE_ID_7715) {
                ret_val = mos7715_parport_init(serial);
-               if (ret_val < 0)
+               if (ret_val < 0) {
+                       usb_kill_urb(serial->port[0]->interrupt_in_urb);
                        return ret_val;
+               }
        }
 #endif
        /* LSR For Port 1 */
@@ -2157,6 +2164,8 @@ static void mos7720_release(struct usb_serial *serial)
 {
        int i;
 
+       usb_kill_urb(serial->port[0]->interrupt_in_urb);
+
 #ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT
        /* close the parallel port */