USB: whiteheat: fix potential null-deref at probe
authorJohan Hovold <johan@kernel.org>
Wed, 23 Sep 2015 18:41:42 +0000 (11:41 -0700)
committerWilly Tarreau <w@1wt.eu>
Sat, 5 Dec 2015 23:49:03 +0000 (00:49 +0100)
commit86a283d33519999a70478f20127ed1fa8af9e3bc
tree75d62f3fefca78a65d33af89bdd541fc3df2c3b6
parentbce7c92e9c2f76cb4f44a360ac0de083ca13dd2f
USB: whiteheat: fix potential null-deref at probe

commit cbb4be652d374f64661137756b8f357a1827d6a4 upstream.

Fix potential null-pointer dereference at probe by making sure that the
required endpoints are present.

The whiteheat driver assumes there are at least five pairs of bulk
endpoints, of which the final pair is used for the "command port". An
attempt to bind to an interface with fewer bulk endpoints would
currently lead to an oops.

Fixes CVE-2015-5257.

Reported-by: Moein Ghasemzadeh <moein@istuary.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Willy Tarreau <w@1wt.eu>
drivers/usb/serial/whiteheat.c