APPLIED: [PATCH] media: imon: Fix null-ptr-deref in imon_probe

[Juerg Haefliger]

Applied to trusty master-next.

...Juerg

On 07/20/2018 02:48 PM, Colin King wrote:
> From: Arvind Yadav <arvind.yadav.cs at gmail.com>
> 
> CVE-2017-16537
> 
> It seems that the return value of usb_ifnum_to_if() can be NULL and
> needs to be checked.
> 
> Signed-off-by: Arvind Yadav <arvind.yadav.cs at gmail.com>
> Tested-by: Andrey Konovalov <andreyknvl at google.com>
> Signed-off-by: Sean Young <sean at mess.org>
> Signed-off-by: Mauro Carvalho Chehab <mchehab at osg.samsung.com>
> (clean upstream cherry pick from commit 58fd55e838276a0c13d1dc7c387f90f25063cbf3)
> Signed-off-by: Colin Ian King <colin.king at canonical.com>
> ---
>  drivers/media/rc/imon.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
> index 9724fe8..9fef8cc 100644
> --- a/drivers/media/rc/imon.c
> +++ b/drivers/media/rc/imon.c
> @@ -2515,6 +2515,11 @@ static int imon_probe(struct usb_interface *interface,
>  	mutex_lock(&driver_lock);
>  
>  	first_if = usb_ifnum_to_if(usbdev, 0);
> +	if (!first_if) {
> +		ret = -ENODEV;
> +		goto fail;
> +	}
> +
>  	first_if_ctx = usb_get_intfdata(first_if);
>  
>  	if (ifnum == 0) {
> 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20180725/84a4be5e/attachment.sig>