lkml.org 
[lkml]   [2021]   [Dec]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: [PATCH] usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init()
Date
Only fixed Peter Chen address email:
peter.chen@nxp.com doesn't exist, should be peter.chen@kernel.org

>-----Original Message-----
>From: Pawel Laszczak
>Sent: Wednesday, December 1, 2021 8:28 AM
>To: Zhou Qingyang <zhou1615@umn.edu>
>Cc: kjlu@umn.edu; Greg Kroah-Hartman <gregkh@linuxfoundation.org>; Peter Chen <peter.chen@nxp.com>; linux-
>usb@vger.kernel.org; linux-kernel@vger.kernel.org
>Subject: RE: [PATCH] usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init()
>
>>
>>In cdnsp_endpoint_init(), cdnsp_ring_alloc() is assigned to pep->ring
>>and there is a dereference of it in cdnsp_endpoint_init(), which could
>>lead to a NULL pointer dereference on failure of cdnsp_ring_alloc().
>>
>>Fix this bug by adding a check of pep->ring.
>>
>>This bug was found by a static analyzer. The analysis employs
>>differential checking to identify inconsistent security operations
>>(e.g., checks or kfrees) between two code paths and confirms that the
>>inconsistent operations are not recovered in the current function or
>>the callers, so they constitute bugs.
>>
>>Note that, as a bug found by static analysis, it can be a false
>>positive or hard to trigger. Multiple researchers have cross-reviewed
>>the bug.
>>
>>Builds with CONFIG_USB_CDNSP_GADGET=y show no new warnings,
>>and our static analyzer no longer warns about this code.
>>
>>Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
>>Signed-off-by: Zhou Qingyang <zhou1615@umn.edu>
>>---
>> drivers/usb/cdns3/cdnsp-mem.c | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>>diff --git a/drivers/usb/cdns3/cdnsp-mem.c b/drivers/usb/cdns3/cdnsp-mem.c
>>index ad9aee3f1e39..97866bfb2da9 100644
>>--- a/drivers/usb/cdns3/cdnsp-mem.c
>>+++ b/drivers/usb/cdns3/cdnsp-mem.c
>>@@ -987,6 +987,9 @@ int cdnsp_endpoint_init(struct cdnsp_device *pdev,
>>
>> /* Set up the endpoint ring. */
>> pep->ring = cdnsp_ring_alloc(pdev, 2, ring_type, max_packet, mem_flags);
>>+ if (!pep->ring)
>>+ return -ENOMEM;
>>+
>> pep->skip = false;
>>
>> /* Fill the endpoint context */
>>--
>>2.25.1
>
>
>Acked-by: Pawel Laszczak <pawell@cadence.com>
>
>--
>
>Thanks,
>Pawel Laszczak

\
 
 \ /
  Last update: 2021-12-01 08:39    [W:0.312 / U:0.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site