forked from Minki/linux
USB: serial: io_edgeport: handle unbound ports on URB completion
Check for NULL port data in the shared interrupt and bulk completion
callbacks to avoid dereferencing a NULL pointer in case a device sends
data for a port device which isn't bound to a driver (e.g. due to a
malicious device having unexpected endpoints or after an allocation
failure on port probe).
Fixes: 1da177e4c3
("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
This commit is contained in:
parent
4d5ef53f75
commit
e37d1aeda7
@ -716,7 +716,7 @@ static void edge_interrupt_callback(struct urb *urb)
|
||||
if (txCredits) {
|
||||
port = edge_serial->serial->port[portNumber];
|
||||
edge_port = usb_get_serial_port_data(port);
|
||||
if (edge_port->open) {
|
||||
if (edge_port && edge_port->open) {
|
||||
spin_lock_irqsave(&edge_port->ep_lock,
|
||||
flags);
|
||||
edge_port->txCredits += txCredits;
|
||||
@ -1825,7 +1825,7 @@ static void process_rcvd_data(struct edgeport_serial *edge_serial,
|
||||
port = edge_serial->serial->port[
|
||||
edge_serial->rxPort];
|
||||
edge_port = usb_get_serial_port_data(port);
|
||||
if (edge_port->open) {
|
||||
if (edge_port && edge_port->open) {
|
||||
dev_dbg(dev, "%s - Sending %d bytes to TTY for port %d\n",
|
||||
__func__, rxLen,
|
||||
edge_serial->rxPort);
|
||||
|
Loading…
Reference in New Issue
Block a user