Commit 2ae4605d authored by Karsten Keil's avatar Karsten Keil Committed by David S. Miller

ISDN: Add check for usb_alloc_urb() result

usb_alloc_urb() return value needs to be checked to avoid
later NULL pointer access.
Reported by rucsoftsec@gmail.com via bugzilla.kernel.org #44601.
Signed-off-by: default avatarKarsten Keil <kkeil@linux-pingi.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5b999fd0
...@@ -2084,13 +2084,21 @@ hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id) ...@@ -2084,13 +2084,21 @@ hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id)
/* create the control pipes needed for register access */ /* create the control pipes needed for register access */
hw->ctrl_in_pipe = usb_rcvctrlpipe(hw->dev, 0); hw->ctrl_in_pipe = usb_rcvctrlpipe(hw->dev, 0);
hw->ctrl_out_pipe = usb_sndctrlpipe(hw->dev, 0); hw->ctrl_out_pipe = usb_sndctrlpipe(hw->dev, 0);
driver_info = (struct hfcsusb_vdata *)
hfcsusb_idtab[vend_idx].driver_info;
hw->ctrl_urb = usb_alloc_urb(0, GFP_KERNEL); hw->ctrl_urb = usb_alloc_urb(0, GFP_KERNEL);
if (!hw->ctrl_urb) {
pr_warn("%s: No memory for control urb\n",
driver_info->vend_name);
kfree(hw);
return -ENOMEM;
}
driver_info = pr_info("%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n",
(struct hfcsusb_vdata *)hfcsusb_idtab[vend_idx].driver_info; hw->name, __func__, driver_info->vend_name,
printk(KERN_DEBUG "%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n", conf_str[small_match], ifnum, alt_used);
hw->name, __func__, driver_info->vend_name,
conf_str[small_match], ifnum, alt_used);
if (setup_instance(hw, dev->dev.parent)) if (setup_instance(hw, dev->dev.parent))
return -EIO; return -EIO;
......
...@@ -1483,13 +1483,21 @@ hfc_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) ...@@ -1483,13 +1483,21 @@ hfc_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
usb_rcvctrlpipe(context->dev, 0); usb_rcvctrlpipe(context->dev, 0);
context->ctrl_out_pipe = context->ctrl_out_pipe =
usb_sndctrlpipe(context->dev, 0); usb_sndctrlpipe(context->dev, 0);
driver_info = (hfcsusb_vdata *)
hfcusb_idtab[vend_idx].driver_info;
context->ctrl_urb = usb_alloc_urb(0, GFP_KERNEL); context->ctrl_urb = usb_alloc_urb(0, GFP_KERNEL);
driver_info = if (!context->ctrl_urb) {
(hfcsusb_vdata *) hfcusb_idtab[vend_idx]. pr_warn("%s: No memory for control urb\n",
driver_info; driver_info->vend_name);
printk(KERN_INFO "HFC-S USB: detected \"%s\"\n", kfree(context);
driver_info->vend_name); return -ENOMEM;
}
pr_info("HFC-S USB: detected \"%s\"\n",
driver_info->vend_name);
DBG(HFCUSB_DBG_INIT, DBG(HFCUSB_DBG_INIT,
"HFC-S USB: Endpoint-Config: %s (if=%d alt=%d), E-Channel(%d)", "HFC-S USB: Endpoint-Config: %s (if=%d alt=%d), E-Channel(%d)",
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment