Messages in this thread | | | From | Pawel Laszczak <> | Subject | RE: [PATCH] usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init() | Date | Wed, 1 Dec 2021 07:39:05 +0000 |
| |
Only fixed Peter Chen address email: peter.chen@nxp.com doesn't exist, should be peter.chen@kernel.org
>-----Original Message----- >From: Pawel Laszczak >Sent: Wednesday, December 1, 2021 8:28 AM >To: Zhou Qingyang <zhou1615@umn.edu> >Cc: kjlu@umn.edu; Greg Kroah-Hartman <gregkh@linuxfoundation.org>; Peter Chen <peter.chen@nxp.com>; linux- >usb@vger.kernel.org; linux-kernel@vger.kernel.org >Subject: RE: [PATCH] usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init() > >> >>In cdnsp_endpoint_init(), cdnsp_ring_alloc() is assigned to pep->ring >>and there is a dereference of it in cdnsp_endpoint_init(), which could >>lead to a NULL pointer dereference on failure of cdnsp_ring_alloc(). >> >>Fix this bug by adding a check of pep->ring. >> >>This bug was found by a static analyzer. The analysis employs >>differential checking to identify inconsistent security operations >>(e.g., checks or kfrees) between two code paths and confirms that the >>inconsistent operations are not recovered in the current function or >>the callers, so they constitute bugs. >> >>Note that, as a bug found by static analysis, it can be a false >>positive or hard to trigger. Multiple researchers have cross-reviewed >>the bug. >> >>Builds with CONFIG_USB_CDNSP_GADGET=y show no new warnings, >>and our static analyzer no longer warns about this code. >> >>Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") >>Signed-off-by: Zhou Qingyang <zhou1615@umn.edu> >>--- >> drivers/usb/cdns3/cdnsp-mem.c | 3 +++ >> 1 file changed, 3 insertions(+) >> >>diff --git a/drivers/usb/cdns3/cdnsp-mem.c b/drivers/usb/cdns3/cdnsp-mem.c >>index ad9aee3f1e39..97866bfb2da9 100644 >>--- a/drivers/usb/cdns3/cdnsp-mem.c >>+++ b/drivers/usb/cdns3/cdnsp-mem.c >>@@ -987,6 +987,9 @@ int cdnsp_endpoint_init(struct cdnsp_device *pdev, >> >> /* Set up the endpoint ring. */ >> pep->ring = cdnsp_ring_alloc(pdev, 2, ring_type, max_packet, mem_flags); >>+ if (!pep->ring) >>+ return -ENOMEM; >>+ >> pep->skip = false; >> >> /* Fill the endpoint context */ >>-- >>2.25.1 > > >Acked-by: Pawel Laszczak <pawell@cadence.com> > >-- > >Thanks, >Pawel Laszczak
| |