APPLIED: [PATCH] usb: usbtest: fix NULL pointer dereference

[Juerg Haefliger]

Applied to trusty master-next.

...Juerg


On 07/20/2018 02:38 PM, Colin King wrote:
> From: Alan Stern <stern at rowland.harvard.edu>
> 
> CVE-2017-16532
> 
> If the usbtest driver encounters a device with an IN bulk endpoint but
> no OUT bulk endpoint, it will try to dereference a NULL pointer
> (out->desc.bEndpointAddress).  The problem can be solved by adding a
> missing test.
> 
> Signed-off-by: Alan Stern <stern at rowland.harvard.edu>
> Reported-by: Andrey Konovalov <andreyknvl at google.com>
> Tested-by: Andrey Konovalov <andreyknvl at google.com>
> Signed-off-by: Felipe Balbi <felipe.balbi at linux.intel.com>
> (upstream cherry pick of commit 7c80f9e4a588f1925b07134bb2e3689335f6c6d8)
> Signed-off-by: Colin Ian King <colin.king at canonical.com>
> ---
>  drivers/usb/misc/usbtest.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
> index 113e38b..b3fc602 100644
> --- a/drivers/usb/misc/usbtest.c
> +++ b/drivers/usb/misc/usbtest.c
> @@ -202,12 +202,13 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
>  			return tmp;
>  	}
>  
> -	if (in) {
> +	if (in)
>  		dev->in_pipe = usb_rcvbulkpipe(udev,
>  			in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
> +	if (out)
>  		dev->out_pipe = usb_sndbulkpipe(udev,
>  			out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
> -	}
> +
>  	if (iso_in) {
>  		dev->iso_in = &iso_in->desc;
>  		dev->in_iso_pipe = usb_rcvisocpipe(udev,
> 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20180725/a40b0d70/attachment.sig>