usb: Fix null-ptr-deref in qt2_process_read_urb()

Quoted 2 lines · Qasim Ijaz

This patch addresses a null-ptr-deref in qt2_process_read_urb() due to an incorrect bounds check in the following:

Thanks for the fix. This looks correct, but your patch is whitespace damaged (tabs replaced with spaces) and does not apply.

Can you please fix your mail setup and resend a v3? (Make sure to send it to yourself first.)

When doing so, please use the common patch prefix for this driver:

USB: serial: quatech2:

Quoted 1 line

""

You can drop these (markup?) quotes.

Quoted 17 lines

       if (newport > serial->num_ports) {
               dev_err(&port->dev,
                       "%s - port change to invalid port: %i\n",
                       __func__, newport);
               break;
       }

""

The condition doesn't account for the valid range of the serial->port buffer, which is from 0 to serial->num_ports - 1. When newport is equal to serial->num_ports, the assignment of "port" in the following code is out-of-bounds and NULL:

""

       serial_priv->current_port = newport;
       port = serial->port[serial_priv->current_port];

Quoted 8 lines

""

The fix checks if newport is greater than or equal to serial->num_ports indicating it is out-of-bounds.

Reported-by syzbot <[email protected]>

Closes https://syzkaller.appspot.com/bug?extid=506479ebf12fe435d01a

Signed-off-by Qasim Ijaz <[email protected]>

And please include a Fixes and CC stable tag:

	Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver")
	Cc: [email protected]	# 3.5

Johan