From patchwork Fri Jul 13 08:59:46 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Karsten Keil X-Patchwork-Id: 170831 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 843822C0334 for ; Fri, 13 Jul 2012 19:00:02 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755917Ab2GMI75 (ORCPT ); Fri, 13 Jul 2012 04:59:57 -0400 Received: from moutng.kundenserver.de ([212.227.126.171]:50994 "EHLO moutng.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752875Ab2GMI7y (ORCPT ); Fri, 13 Jul 2012 04:59:54 -0400 Received: from mailone.linux-pingi.de (p5DC7A2FB.dip.t-dialin.net [93.199.162.251]) by mrelayeu.kundenserver.de (node=mreu4) with ESMTP (Nemesis) id 0Loeg3-1S8rzb12Al-00glA2; Fri, 13 Jul 2012 10:59:48 +0200 Received: from pingi6.linux-pingi.de (pingi6.linux-pingi.de [10.23.200.6]) by mailone.linux-pingi.de (Postfix) with ESMTPS id 50544B004A; Fri, 13 Jul 2012 10:59:45 +0200 (CEST) Received: by pingi6.linux-pingi.de (Postfix, from userid 4000) id D354925E; Fri, 13 Jul 2012 10:59:46 +0200 (CEST) From: Karsten Keil To: David Miller Cc: netdev@vger.kernel.org, rucsoftsec@gmail.com, m.bachem@gmx.de Subject: [PATCH ISDN] Add check for usb_alloc_urb() result Date: Fri, 13 Jul 2012 10:59:46 +0200 Message-Id: <1342169986-24268-1-git-send-email-kkeil@linux-pingi.de> X-Mailer: git-send-email 1.7.7 X-Provags-ID: V02:K0:dgDCb+nV5cBMDS8ICAETN0zcx4+Qgf7Y/DeaKtCyqHD 8dwK1fEmM3dzm4RosHKtIijhjZCMF01kImdftOLQwmktMnwTXz Sc1LUAbdWfUhhaR9KzyIELh1T1tJPiLntA+nHJz63wlShA8+nY sMgtmyoNyw4YcsrFgslbCqwkCEQ8IvAh8TqN/YHQnvJgsb+0Jq rfVv586IGWIT9QNF8D1Orszx945D/NgWf2jNqt0FhC+Rmfuc1i DSceaq+EWLpNefE++8yJs03NItpy52VyqpxP/Y9lyNcsZJfao9 6Sxjg3vjuev3knK7E55VD2+0mfEDWUMdIif1144dOBoQytYH7r 8CovZgqriALsw8mmSyFfpemAyxUqpSEw6p1VXsC8uGZrAYyPAZ azcB1lv2Y6XpsHLYYT6ewBtTagT0tFw820= Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org usb_alloc_urb() return value needs to be checked to avoid later NULL pointer access. Reported by rucsoftsec@gmail.com via bugzilla.kernel.org #44601. Signed-off-by: Karsten Keil --- drivers/isdn/hardware/mISDN/hfcsusb.c | 18 +++++++++++++----- drivers/isdn/hisax/hfc_usb.c | 18 +++++++++++++----- 2 files changed, 26 insertions(+), 10 deletions(-) diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c index c65c344..114f3bc 100644 --- a/drivers/isdn/hardware/mISDN/hfcsusb.c +++ b/drivers/isdn/hardware/mISDN/hfcsusb.c @@ -2084,13 +2084,21 @@ hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id) /* create the control pipes needed for register access */ hw->ctrl_in_pipe = usb_rcvctrlpipe(hw->dev, 0); hw->ctrl_out_pipe = usb_sndctrlpipe(hw->dev, 0); + + driver_info = (struct hfcsusb_vdata *) + hfcsusb_idtab[vend_idx].driver_info; + hw->ctrl_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!hw->ctrl_urb) { + pr_warn("%s: No memory for control urb\n", + driver_info->vend_name); + kfree(hw); + return -ENOMEM; + } - driver_info = - (struct hfcsusb_vdata *)hfcsusb_idtab[vend_idx].driver_info; - printk(KERN_DEBUG "%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n", - hw->name, __func__, driver_info->vend_name, - conf_str[small_match], ifnum, alt_used); + pr_info("%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n", + hw->name, __func__, driver_info->vend_name, + conf_str[small_match], ifnum, alt_used); if (setup_instance(hw, dev->dev.parent)) return -EIO; diff --git a/drivers/isdn/hisax/hfc_usb.c b/drivers/isdn/hisax/hfc_usb.c index 84f9c81..849a807 100644 --- a/drivers/isdn/hisax/hfc_usb.c +++ b/drivers/isdn/hisax/hfc_usb.c @@ -1483,13 +1483,21 @@ hfc_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) usb_rcvctrlpipe(context->dev, 0); context->ctrl_out_pipe = usb_sndctrlpipe(context->dev, 0); + + driver_info = (hfcsusb_vdata *) + hfcusb_idtab[vend_idx].driver_info; + context->ctrl_urb = usb_alloc_urb(0, GFP_KERNEL); - driver_info = - (hfcsusb_vdata *) hfcusb_idtab[vend_idx]. - driver_info; - printk(KERN_INFO "HFC-S USB: detected \"%s\"\n", - driver_info->vend_name); + if (!context->ctrl_urb) { + pr_warn("%s: No memory for control urb\n", + driver_info->vend_name); + kfree(context); + return -ENOMEM; + } + + pr_info("HFC-S USB: detected \"%s\"\n", + driver_info->vend_name); DBG(HFCUSB_DBG_INIT, "HFC-S USB: Endpoint-Config: %s (if=%d alt=%d), E-Channel(%d)",