usb: fail on usb_hub_create_port_device() errors

commit e58547eb9561a8a72d46e2d411090a614d33ac0e upstream.

Ignoring usb_hub_create_port_device() errors cause later NULL pointer
deference when uninitialized hub->ports[i] entries are dereferenced
after port memory allocation error.

Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 8 insertions, 2 deletions

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index a7515d165390..896532d3fc2d 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1557,10 +1557,15 @@ static int hub_configure(struct usb_hub *hub,
         if (hub->has_indicators && blinkenlights)
                 hub->indicator [0] = INDICATOR_CYCLE;
 
-        for (i = 0; i < hdev->maxchild; i++)
-                if (usb_hub_create_port_device(hub, i + 1) < 0)
+        for (i = 0; i < hdev->maxchild; i++) {
+                ret = usb_hub_create_port_device(hub, i + 1);
+                if (ret < 0) {
                         dev_err(hub->intfdev,
                                 "couldn't create port%d device.\n", i + 1);
+                        hdev->maxchild = i;
+                        goto fail_keep_maxchild;
+                }
+        }
 
         usb_hub_adjust_deviceremovable(hdev, hub->descriptor);
 
@@ -1569,6 +1574,7 @@ static int hub_configure(struct usb_hub *hub,
 
 fail:
         hdev->maxchild = 0;
+fail_keep_maxchild:
         dev_err (hub_dev, "config failed, %s (err %d)\n",
                         message, ret);
         /* hub_disconnect() frees urb and descriptor */