Commit b0addd3f authored Mar 13, 2017 by Johan Hovold Committed by Greg Kroah-Hartman Mar 14, 2017

USB: idmouse: fix NULL-deref at probe



Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 4495c08e

drivers/usb/misc/idmouse.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -347,6 +347,9 @@ static int idmouse_probe(struct usb_interface *interface,
		if (iface_desc->desc.bInterfaceClass != 0x0A)
		return -ENODEV;

		if (iface_desc->desc.bNumEndpoints < 1)
		return -ENODEV;

		/* allocate memory for our device state and initialize it */
		dev = kzalloc(sizeof(*dev), GFP_KERNEL);
		if (dev == NULL)

Admin message