lkml.org 
[lkml]   [2019]   [Mar]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] USB: storage: Fix potential NULL pointer derefernce
On Wed, 13 Mar 2019, Aditya Pakki wrote:

> Allocating memory via kcalloc for pba_to_lba and lba_to_pba can
> fail. The fix avoids a potential NULL pointer dereference.
>
> Signed-off-by: Aditya Pakki <pakki001@umn.edu>
> ---
> drivers/usb/storage/alauda.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
> index 6b8edf6178df..41d979e70784 100644
> --- a/drivers/usb/storage/alauda.c
> +++ b/drivers/usb/storage/alauda.c
> @@ -438,6 +438,11 @@ static int alauda_init_media(struct us_data *us)
> MEDIA_INFO(us).pba_to_lba = kcalloc(num_zones, sizeof(u16*), GFP_NOIO);
> MEDIA_INFO(us).lba_to_pba = kcalloc(num_zones, sizeof(u16*), GFP_NOIO);
>
> + if (!MEDIA_INFO(us).pba_to_lba || !MEDIA_INFO(us).lba_to_pba) {
> + pr_warn("%s: Failed to allocate memory\n", __func__);
> + return USB_STOR_TRANSPORT_ERROR;
> + }
> +
> if (alauda_reset_media(us) != USB_STOR_XFER_GOOD)
> return USB_STOR_TRANSPORT_ERROR;

In fact this won't accomplish anything, because the return value from
alauda_init_media() isn't used. The driver appears to need more than
a single change.

Alan Stern

\
 
 \ /
  Last update: 2019-03-13 19:01    [W:0.055 / U:0.260 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site