USB: wusbcore: fix NULL-deref at probe

commit 03ace94 upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints. This specifically fixes the NULL-pointer dereference when probing HWA HC devices. Fixes: df36542 ("wusb: add the Wire Adapter (WA) core") Cc: Inaky Perez-Gonzalez <[email protected]> Cc: David Vrabel <[email protected]> Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Jiri Slaby <[email protected]>
ammarfaizi2 · Apr 7, 2017 · 84eeabc · 84eeabc
1 parent 51f5541
commit 84eeabc
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/drivers/usb/wusbcore/wa-hc.c b/drivers/usb/wusbcore/wa-hc.c
@@ -38,6 +38,9 @@ int wa_create(struct wahc *wa, struct usb_interface *iface)
 	int result;
 	struct device *dev = &iface->dev;
 
+	if (iface->cur_altsetting->desc.bNumEndpoints < 3)
+		return -ENODEV;
+
 	result = wa_rpipes_create(wa);
 	if (result < 0)
 		goto error_rpipes_create;