From d6880e88433ebcdf2e485f8725328d144686b605 Mon Sep 17 00:00:00 2001 From: Luis Henriques Date: Tue, 22 Apr 2014 17:59:39 +0100 Subject: [PATCH] USB: usb_wwan: fix a NULL pointer dereference BugLink: http://bugs.launchpad.net/bugs/1308537 [ 7644.626036] BUG: unable to handle kernel NULL pointer dereference at 0000000000000068 [ 7644.626041] IP: [] usb_wwan_write+0x124/0x2d0 [usb_wwan] [ 7644.626046] PGD 23fc66067 PUD 23fc67067 PMD 0 [ 7644.626049] Oops: 0000 [#1] SMP [ 7644.626051] Modules linked in: ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT xt_CHECKSUM iptable_mangle xt_tcpudp bridge stp llc ip6table_filter ip6_tables iptable_filter ip_tables ebtable_nat ebtables x_tables nvram rfcomm bnep binfmt_misc nls_iso8859_1 parport_pc ppdev lp parport uvcvideo qmi_wwan videobuf2_vmalloc videobuf2_memops videobuf2_core cdc_wdm videodev usbnet option usb_wwan usbserial ath3k btusb bluetooth joydev snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi intel_rapl snd_hda_intel x86_pkg_temp_thermal intel_powerclamp snd_hda_controller snd_hda_codec snd_hwdep snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi arc4 coretemp ath9k snd_seq snd_seq_device ath9k_common kvm_intel kvm ath9k_hw ath snd_timer mac80211 cfg80211 psmouse snd serio_raw soundcore mei_me mei microcode sparse_keymap toshiba_bluetooth mac_hid lpc_ich btrfs xor raid6_pq dm_crypt usb_storage radeon crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel aes_x86_64 lrw i2c_algo_bit gf128mul ttm glue_helper ablk_helper drm_kms_helper cryptd ahci drm r8169 libahci mii wmi video [ 7644.626099] CPU: 0 PID: 1977 Comm: ModemManager Not tainted 3.15.0-031500rc1-generic #201404131835 [ 7644.626101] Hardware name: TOSHIBA SATELLITE L870-18Z/PLCSF8, BIOS 6.60 4/03/2013 [ 7644.626102] task: ffff8800354a8000 ti: ffff880035496000 task.ti: ffff880035496000 [ 7644.626103] RIP: 0010:[] [] usb_wwan_write+0x124/0x2d0 [usb_wwan] [ 7644.626106] RSP: 0018:ffff880035497d08 EFLAGS: 00010283 [ 7644.626107] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000001 [ 7644.626108] RDX: 0000000000000000 RSI: 0000000000220020 RDI: 0000000000000202 [ 7644.626109] RBP: ffff880035497d78 R08: 0000000000000000 R09: 0000000000000000 [ 7644.626110] R10: 0000000000000001 R11: 0000000000000293 R12: ffff8800ad89fc00 [ 7644.626111] R13: 0000000000000000 R14: 0000000000000001 R15: ffff8801a4850580 [ 7644.626112] FS: 00007ff63b428840(0000) GS:ffff88024ec00000(0000) knlGS:0000000000000000 [ 7644.626113] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7644.626114] CR2: 0000000000000068 CR3: 000000023fc81000 CR4: 00000000001407f0 [ 7644.626115] Stack: [ 7644.626116] ffff8801ce349600 ffff8801a44532f0 ffff8800ad89fc90 ffff8801a4453000 [ 7644.626118] ffff8800ad89fc80 ffff880035567800 ffff8801a4a6a000 ffffffff00000001 [ 7644.626120] ffff8801ce348100 ffff880035567800 ffff8801a4453000 0000000000000001 [ 7644.626122] Call Trace: [ 7644.626126] [] serial_write+0x5f/0xc0 [usbserial] [ 7644.626130] [] n_tty_write+0x156/0x350 [ 7644.626135] [] ? try_to_wake_up+0x210/0x210 [ 7644.626137] [] do_tty_write+0xb9/0x1e0 [ 7644.626139] [] ? n_tty_receive_char_closing+0xc0/0xc0 [ 7644.626141] [] tty_write+0xa4/0xf0 [ 7644.626144] [] vfs_write+0xcb/0x1f0 [ 7644.626146] [] SyS_write+0x4f/0xb0 [ 7644.626148] [] tracesys+0xe1/0xe6 [ 7644.626149] Code: 05 93 26 00 00 04 0f 85 23 01 00 00 48 8b 55 a8 48 8b 02 48 8b 78 10 e8 cb 8c d7 e0 85 c0 0f 88 03 01 00 00 41 81 fe 00 10 00 00 <49> 8b 7d 68 48 8b 75 c0 b8 00 10 00 00 41 0f 4e c6 48 63 d0 89 [ 7644.626169] RIP [] usb_wwan_write+0x124/0x2d0 [usb_wwan] [ 7644.626172] RSP [ 7644.626173] CR2: 0000000000000068 Signed-off-by: Luis Henriques --- drivers/usb/serial/usb_wwan.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c index 8536578..2189b82 100644 --- a/drivers/usb/serial/usb_wwan.c +++ b/drivers/usb/serial/usb_wwan.c @@ -217,6 +217,10 @@ int usb_wwan_write(struct tty_struct *tty, struct usb_serial_port *port, todo = OUT_BUFLEN; this_urb = portdata->out_urbs[i]; + if (this_urb == NULL) { + dev_err(&port->dev, "%s: Invalid URB [%i]\n", __func__, i); + continue; + } if (test_and_set_bit(i, &portdata->out_busy)) { if (time_before(jiffies, portdata->tx_start_time[i] + 10 * HZ)) -- 1.9.1