usb: fail on usb_hub_create_port_device() errors

Ignoring usb_hub_create_port_device() errors cause later NULL pointer
deference when uninitialized hub->ports[i] entries are dereferenced
after port memory allocation error.

Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 22811f1f86f3aa0bc8ebf17e7da915a823c7f720..79ec4a7640cdc412cdacc9442684b28dec5c8fd7 100644 (file)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1562,10 +1562,15 @@ static int hub_configure(struct usb_hub *hub,
        if (hub->has_indicators && blinkenlights)
                hub->indicator [0] = INDICATOR_CYCLE;
 
-       for (i = 0; i < hdev->maxchild; i++)
-               if (usb_hub_create_port_device(hub, i + 1) < 0)
+       for (i = 0; i < hdev->maxchild; i++) {
+               ret = usb_hub_create_port_device(hub, i + 1);
+               if (ret < 0) {
                        dev_err(hub->intfdev,
                                "couldn't create port%d device.\n", i + 1);
+                       hdev->maxchild = i;
+                       goto fail_keep_maxchild;
+               }
+       }
 
        usb_hub_adjust_deviceremovable(hdev, hub->descriptor);
 
@@ -1574,6 +1579,7 @@ static int hub_configure(struct usb_hub *hub,
 
 fail:
        hdev->maxchild = 0;
+fail_keep_maxchild:
        dev_err (hub_dev, "config failed, %s (err %d)\n",
                        message, ret);
        /* hub_disconnect() frees urb and descriptor */