Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

media: flexcop-usb: fix endpoint sanity check

commit 1b976fc6d684 ("media: b2c2-flexcop-usb: add sanity checking") added
an endpoint sanity check to address a NULL-pointer dereference on probe.
Unfortunately the check was done on the current altsetting which was later
changed.

Fix this by moving the sanity check to after the altsetting is changed.

Fixes: 1b976fc6d684 ("media: b2c2-flexcop-usb: add sanity checking")
Cc: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

authored by

Johan Hovold and committed by
Mauro Carvalho Chehab
bca243b1 7e0cfdad

+3 -3
+3 -3
drivers/media/usb/b2c2/flexcop-usb.c
··· 511 511 return ret; 512 512 } 513 513 514 + if (fc_usb->uintf->cur_altsetting->desc.bNumEndpoints < 1) 515 + return -ENODEV; 516 + 514 517 switch (fc_usb->udev->speed) { 515 518 case USB_SPEED_LOW: 516 519 err("cannot handle USB speed because it is too slow."); ··· 546 543 struct flexcop_usb *fc_usb = NULL; 547 544 struct flexcop_device *fc = NULL; 548 545 int ret; 549 - 550 - if (intf->cur_altsetting->desc.bNumEndpoints < 1) 551 - return -ENODEV; 552 546 553 547 if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) { 554 548 err("out of memory\n");