[PATCH] USB: usbcore: usb_set_configuration oops (NULL ptr dereference)

When trying to deconfigure a device via usb_set_configuration(dev, 0),
2.6.16-rc kernels after 55c527187c9d78f840b284d596a0b298bc1493af oops
with "Unable to handle NULL pointer dereference at...". This is due to
an unchecked dereference of cp in the power budget part.

This patch was already included in Linus' tree.

Signed-off-by: Horst Schirmeier <horst@schirmeier.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>

diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 7135e542679d73431d145cee917da3fc18a492f2..96cabeb7aabfccb9d2a58043ae5ba094a3c7d4d5 100644 (file)
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1388,11 +1388,13 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
        if (dev->state != USB_STATE_ADDRESS)
                usb_disable_device (dev, 1);    // Skip ep0
 
-       i = dev->bus_mA - cp->desc.bMaxPower * 2;
-       if (i < 0)
-               dev_warn(&dev->dev, "new config #%d exceeds power "
-                               "limit by %dmA\n",
-                               configuration, -i);
+       if (cp) {
+               i = dev->bus_mA - cp->desc.bMaxPower * 2;
+               if (i < 0)
+                       dev_warn(&dev->dev, "new config #%d exceeds power "
+                                       "limit by %dmA\n",
+                                       configuration, -i);
+       }
 
        if ((ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
                        USB_REQ_SET_CONFIGURATION, 0, configuration, 0,