From patchwork Tue Mar 7 18:14:13 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 9609611 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 8DA3E604DD for ; Tue, 7 Mar 2017 18:20:51 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 87043284D0 for ; Tue, 7 Mar 2017 18:20:51 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7BB4A28505; Tue, 7 Mar 2017 18:20:51 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DF70E284D0 for ; Tue, 7 Mar 2017 18:20:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933010AbdCGSUJ (ORCPT ); Tue, 7 Mar 2017 13:20:09 -0500 Received: from mail-lf0-f65.google.com ([209.85.215.65]:32806 "EHLO mail-lf0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932683AbdCGST6 (ORCPT ); Tue, 7 Mar 2017 13:19:58 -0500 Received: by mail-lf0-f65.google.com with SMTP id r36so761532lfi.0; Tue, 07 Mar 2017 10:19:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id; bh=SaF1qj+nlt2nxgRpiMgYglVrAM3CpETx8td27+GFX/M=; b=CH+QOWJooAzjPVqJDkYmSANBK2f64KHSpcT3zBrg8aen4BHgg76tkOWW8C38bGV0FF 1Qu09gWGo8pmPiegT91jdE4LB+uvd+bZBZxEGy14ZrkW50Xbvcx+bJFRHMgQpgQ01byU 8103kJVED1ErPL8EzG/p4EN+gEl315gEUrXh9G3cnbcaiOjp/Poz/41zMs5sBRUckXVW D2YqcFs++ElboVyjZm8zo+g+DdjEc1UByjiE4xGK/jQDa15krJ7VnloJXx4c5keNq73N 3xD68aroXWFKhnJyVs9cds/BDJBrXkSUCUlvFse+RRC1XuH7HiMpIsVNV1t4/2Y/9TOF B7FQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id; bh=SaF1qj+nlt2nxgRpiMgYglVrAM3CpETx8td27+GFX/M=; b=BTJ5SzEAH5WbqJCod7PiTJB1y4Ckrh42rSjXiz1GIfgZQU5oTiX0z8BfgjIj1sT+PY PC1chpMwbgRHBWj5eanZfyF9lz+H/A4x799aU5Igs/MWitI/n6qVL3exbaPIfmoL+fps nY/qLs1h8nLniWSJDmOcQfTDzFDiRlHr2QcSfH1iapoua8BLQlJ+/SFK+xfExIad/V9u 4l6+4NT8jLzTXcwQaKoouRiHAfMtbs0vL5P2Nikf8RgpdjljdZ8YFy8K/cJQLJqLD/J1 MFNmZCjg+YGr8mfJquI0jOFk6e5CeVlPFEhBQ9HuQkwGpxMn2SBQzi3Q55bZsd1v8X6b 26UA== X-Gm-Message-State: AMke39m9GNYM3GvuLFFfjn91UnwKCK7AAQTowJ++27PB+nuncVIZFzu5nnuQcm0v01tnZA== X-Received: by 10.25.221.195 with SMTP id w64mr448274lfi.31.1488910521961; Tue, 07 Mar 2017 10:15:21 -0800 (PST) Received: from xi.terra ([84.216.234.102]) by smtp.gmail.com with ESMTPSA id 1sm131927ljo.43.2017.03.07.10.15.20 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 07 Mar 2017 10:15:21 -0800 (PST) Received: from johan by xi.terra with local (Exim 4.89_RC7) (envelope-from ) id 1clJdm-0001tr-Jt; Tue, 07 Mar 2017 19:15:19 +0100 From: Johan Hovold To: Mauro Carvalho Chehab Cc: Jarod Wilson , linux-media@vger.kernel.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Johan Hovold Subject: [PATCH] [media] mceusb: fix NULL-deref at probe Date: Tue, 7 Mar 2017 19:14:13 +0100 Message-Id: <20170307181413.7264-1-johan@kernel.org> X-Mailer: git-send-email 2.12.0 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Make sure to check for the required out endpoint to avoid dereferencing a NULL-pointer in mce_request_packet should a malicious device lack such an endpoint. Note that this path it hit during probe. Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver") Cc: stable # 2.6.36 Signed-off-by: Johan Hovold --- Found through inspection, compile tested only. Johan drivers/media/rc/mceusb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c index 238d8eaf7d94..93b16fe3ab38 100644 --- a/drivers/media/rc/mceusb.c +++ b/drivers/media/rc/mceusb.c @@ -1288,8 +1288,8 @@ static int mceusb_dev_probe(struct usb_interface *intf, } } } - if (ep_in == NULL) { - dev_dbg(&intf->dev, "inbound and/or endpoint not found"); + if (!ep_in || !ep_out) { + dev_dbg(&intf->dev, "required endpoints not found\n"); return -ENODEV; }