patch "USB: serial: mos7840: fix another NULL-deref at open" added to usb-next

This is a note to let you know that I've just added the patch titled

USB: serial: mos7840: fix another NULL-deref at open

to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-next branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will also be merged in the next major kernel release during the merge window.

If you have any questions about this process, please let me know.

From: Johan Hovold <[email protected]>
Date: Thu, 9 Feb 2017 12:11:41 +0100
Subject: USB: serial: mos7840: fix another NULL-deref at open

Fix another NULL-pointer dereference at open should a malicious device lack an interrupt-in endpoint.

Note that the driver has a broken check for an interrupt-in endpoint which means that an interrupt URB has never even been submitted.

---
 drivers/usb/serial/mos7840.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

index d1b92f582478..3821c53fcee9 100644
@@ -1034,6 +1034,7 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
 	 * (can't set it up in mos7840_startup as the structures *
 	 * were not set up at that time.)                        */
 	if (port0->open_ports == 1) {
+		/* FIXME: Buffer never NULL, so URB is not submitted. */
 		if (serial->port[0]->interrupt_in_buffer == NULL) {
 			/* set up interrupt urb */
 			usb_fill_int_urb(serial->port[0]->interrupt_in_urb,

@@ -2116,7 +2117,8 @@ static int mos7840_calc_num_ports(struct usb_serial *serial)
 static int mos7840_attach(struct usb_serial *serial)
 {
 	if (serial->num_bulk_in < serial->num_ports ||
-			serial->num_bulk_out < serial->num_ports) {
+			serial->num_bulk_out < serial->num_ports ||
+			serial->num_interrupt_in < 1) {
 		dev_err(&serial->interface->dev, "missing endpoints\n");
 		return -ENODEV;
 	}

2.11.1