| Message ID | 1532096628-22441-2-git-send-email-paolo.pisati@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | [media] cx231xx-cards: fix NULL-deref on missing association descriptor | expand |
On 20.07.2018 16:23, Paolo Pisati wrote: > From: Johan Hovold <johan@kernel.org> > > Make sure to check that we actually have an Interface Association > Descriptor before dereferencing it during probe to avoid dereferencing a > NULL-pointer. > > Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver") > > Cc: stable <stable@vger.kernel.org> # 2.6.30 > Reported-by: Andrey Konovalov <andreyknvl@google.com> > Signed-off-by: Johan Hovold <johan@kernel.org> > Tested-by: Andrey Konovalov <andreyknvl@google.com> > Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> > Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> > (cherry picked from commit 6c3b047fa2d2286d5e438bcb470c7b1a49f415f6) > Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com> Acked-by: Stefan Bader <stefan.bader@canonical.com> > --- Needs CVE-2017-16536 added. > drivers/media/usb/cx231xx/cx231xx-cards.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c > index 528cce9..09d4fb6 100644 > --- a/drivers/media/usb/cx231xx/cx231xx-cards.c > +++ b/drivers/media/usb/cx231xx/cx231xx-cards.c > @@ -1224,7 +1224,7 @@ static int cx231xx_usb_probe(struct usb_interface *interface, > nr = dev->devno; > > assoc_desc = udev->actconfig->intf_assoc[0]; > - if (assoc_desc->bFirstInterface != ifnum) { > + if (!assoc_desc || assoc_desc->bFirstInterface != ifnum) { > cx231xx_err(DRIVER_NAME ": Not found " > "matching IAD interface\n"); > retval = -ENODEV; >
On 07/20/18 16:23, Paolo Pisati wrote: > From: Johan Hovold <johan@kernel.org> > > Make sure to check that we actually have an Interface Association > Descriptor before dereferencing it during probe to avoid dereferencing a > NULL-pointer. > > Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver") > > Cc: stable <stable@vger.kernel.org> # 2.6.30 > Reported-by: Andrey Konovalov <andreyknvl@google.com> > Signed-off-by: Johan Hovold <johan@kernel.org> > Tested-by: Andrey Konovalov <andreyknvl@google.com> > Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> > Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> > (cherry picked from commit 6c3b047fa2d2286d5e438bcb470c7b1a49f415f6) If changes are made to to make it apply we should mark the patch as "(backported from ...)". > Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com> Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> > --- > drivers/media/usb/cx231xx/cx231xx-cards.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c > index 528cce9..09d4fb6 100644 > --- a/drivers/media/usb/cx231xx/cx231xx-cards.c > +++ b/drivers/media/usb/cx231xx/cx231xx-cards.c > @@ -1224,7 +1224,7 @@ static int cx231xx_usb_probe(struct usb_interface *interface, > nr = dev->devno; > > assoc_desc = udev->actconfig->intf_assoc[0]; > - if (assoc_desc->bFirstInterface != ifnum) { > + if (!assoc_desc || assoc_desc->bFirstInterface != ifnum) { > cx231xx_err(DRIVER_NAME ": Not found " > "matching IAD interface\n"); > retval = -ENODEV; >
diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c index 528cce9..09d4fb6 100644 --- a/drivers/media/usb/cx231xx/cx231xx-cards.c +++ b/drivers/media/usb/cx231xx/cx231xx-cards.c @@ -1224,7 +1224,7 @@ static int cx231xx_usb_probe(struct usb_interface *interface, nr = dev->devno; assoc_desc = udev->actconfig->intf_assoc[0]; - if (assoc_desc->bFirstInterface != ifnum) { + if (!assoc_desc || assoc_desc->bFirstInterface != ifnum) { cx231xx_err(DRIVER_NAME ": Not found " "matching IAD interface\n"); retval = -ENODEV;