ISDN: Add check for usb_alloc_urb() result

usb_alloc_urb() return value needs to be checked to avoid
later NULL pointer access.
Reported by rucsoftsec@gmail.com via bugzilla.kernel.org #44601.

Signed-off-by: Karsten Keil <kkeil@linux-pingi.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
index c65c3440cd709217497a7d6d6d410e98b561f185..114f3bcba1b0d90f2a05c64523ba7109014c6eea 100644 (file)
--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -2084,13 +2084,21 @@ hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id)
        /* create the control pipes needed for register access */
        hw->ctrl_in_pipe = usb_rcvctrlpipe(hw->dev, 0);
        hw->ctrl_out_pipe = usb_sndctrlpipe(hw->dev, 0);
+
+       driver_info = (struct hfcsusb_vdata *)
+                     hfcsusb_idtab[vend_idx].driver_info;
+
        hw->ctrl_urb = usb_alloc_urb(0, GFP_KERNEL);
+       if (!hw->ctrl_urb) {
+               pr_warn("%s: No memory for control urb\n",
+                       driver_info->vend_name);
+               kfree(hw);
+               return -ENOMEM;
+       }
 
-       driver_info =
-               (struct hfcsusb_vdata *)hfcsusb_idtab[vend_idx].driver_info;
-       printk(KERN_DEBUG "%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n",
-              hw->name, __func__, driver_info->vend_name,
-              conf_str[small_match], ifnum, alt_used);
+       pr_info("%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n",
+               hw->name, __func__, driver_info->vend_name,
+               conf_str[small_match], ifnum, alt_used);
 
        if (setup_instance(hw, dev->dev.parent))
                return -EIO;

diff --git a/drivers/isdn/hisax/hfc_usb.c b/drivers/isdn/hisax/hfc_usb.c
index 84f9c810307843cdf7c9ee884ac48856ba0be233..849a80752685bdab2ad945824eadd03c924ff7f5 100644 (file)
--- a/drivers/isdn/hisax/hfc_usb.c
+++ b/drivers/isdn/hisax/hfc_usb.c
@@ -1483,13 +1483,21 @@ hfc_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
                                usb_rcvctrlpipe(context->dev, 0);
                        context->ctrl_out_pipe =
                                usb_sndctrlpipe(context->dev, 0);
+
+                       driver_info = (hfcsusb_vdata *)
+                                     hfcusb_idtab[vend_idx].driver_info;
+
                        context->ctrl_urb = usb_alloc_urb(0, GFP_KERNEL);
 
-                       driver_info =
-                               (hfcsusb_vdata *) hfcusb_idtab[vend_idx].
-                               driver_info;
-                       printk(KERN_INFO "HFC-S USB: detected \"%s\"\n",
-                              driver_info->vend_name);
+                       if (!context->ctrl_urb) {
+                               pr_warn("%s: No memory for control urb\n",
+                                       driver_info->vend_name);
+                               kfree(context);
+                               return -ENOMEM;
+                       }
+
+                       pr_info("HFC-S USB: detected \"%s\"\n",
+                               driver_info->vend_name);
 
                        DBG(HFCUSB_DBG_INIT,
                            "HFC-S USB: Endpoint-Config: %s (if=%d alt=%d), E-Channel(%d)",