Patch "USB: serial: mos7840: fix another NULL-deref at open" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

USB: serial: mos7840: fix another NULL-deref at open

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
usb-serial-mos7840-fix-another-null-deref-at-open.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Johan Hovold <[email protected]>
Date: Thu, 9 Feb 2017 12:11:41 +0100
Subject: USB: serial: mos7840: fix another NULL-deref at open

From: Johan Hovold <[email protected]>

commit 5182c2cf2a9bfb7f066ef0bdd2bb6330b94dd74e upstream.

Fix another NULL-pointer dereference at open should a malicious device lack an interrupt-in endpoint.

Note that the driver has a broken check for an interrupt-in endpoint which means that an interrupt URB has never even been submitted.

---
 drivers/usb/serial/mos7840.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -1024,6 +1024,7 @@ static int mos7840_open(struct tty_struc
 	 * (can't set it up in mos7840_startup as the structures *
 	 * were not set up at that time.)                        */
 	if (port0->open_ports == 1) {
+		/* FIXME: Buffer never NULL, so URB is not submitted. */
 		if (serial->port[0]->interrupt_in_buffer == NULL) {
 			/* set up interrupt urb */
 			usb_fill_int_urb(serial->port[0]->interrupt_in_urb,

@@ -2119,7 +2120,8 @@ static int mos7840_calc_num_ports(struct
 static int mos7840_attach(struct usb_serial *serial)
 {
 	if (serial->num_bulk_in < serial->num_ports ||
-			serial->num_bulk_out < serial->num_ports) {
+			serial->num_bulk_out < serial->num_ports ||
+			serial->num_interrupt_in < 1) {
 		dev_err(&serial->interface->dev, "missing endpoints\n");
 		return -ENODEV;
 	}

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/usb-serial-ftdi_sio-fix-modem-status-error-handling.patch queue-4.9/usb-serial-cp210x-add-new-ids-for-ge-bx50v3-boards.patch queue-4.9/usb-serial-ark3116-fix-register-accessor-error-handling.patch queue-4.9/usb-serial-digi_acceleport-fix-oob-data-sanity-check.patch queue-4.9/usb-serial-ftdi_sio-fix-line-status-over-reporting.patch queue-4.9/usb-serial-ftdi_sio-fix-extreme-low-latency-setting.patch queue-4.9/usb-serial-spcp8x5-fix-modem-status-handling.patch queue-4.9/usb-serial-opticon-fix-cts-retrieval-at-open.patch queue-4.9/usb-serial-mos7840-fix-another-null-deref-at-open.patch queue-4.9/usb-serial-console-fix-uninitialised-spinlock.patch