From 769d7368b1727b1b5369d88badf0cbdf0163e079 Mon Sep 17 00:00:00 2001 From: David Linares Date: Mon, 25 Mar 2013 10:50:27 +0000 Subject: USB: hub: Avoid NULL pointer dereference when hub doesn't have any ports Return an error if hub->descriptor->bNbrPorts==0. Without this additional check, we can end up doing a "hub->ports = kzalloc(0, GFP_KERNEL)". This hub->ports pointer will therefore be non-NULL and will be used. Example of dmesg: INIT: usb 1-1: New USB device found, idVendor=0424, idProduct=2512 usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 hub 1-1:1.0: USB hub found version 2.86 bootinghub 1-1:1.0: 0 ports detected Unable to handle kernel NULL pointer dereference at virtual address 00000010 Signed-off-by: David Linares Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/hub.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'drivers/usb/core') diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 5480352..7815462 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1317,6 +1317,10 @@ static int hub_configure(struct usb_hub *hub, message = "hub has too many ports!"; ret = -ENODEV; goto fail; + } else if (hub->descriptor->bNbrPorts == 0) { + message = "hub doesn't have any ports!"; + ret = -ENODEV; + goto fail; } hdev->maxchild = hub->descriptor->bNbrPorts; -- cgit v1.1