Messages in this thread | | | Date | Wed, 1 Dec 2021 22:16:07 +0800 | From | Peter Chen <> | Subject | Re: [PATCH] usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init() |
| |
On 21-12-01 07:39:05, Pawel Laszczak wrote: > Only fixed Peter Chen address email: > peter.chen@nxp.com doesn't exist, should be peter.chen@kernel.org > > >-----Original Message----- > >From: Pawel Laszczak > >Sent: Wednesday, December 1, 2021 8:28 AM > >To: Zhou Qingyang <zhou1615@umn.edu> > >Cc: kjlu@umn.edu; Greg Kroah-Hartman <gregkh@linuxfoundation.org>; Peter Chen <peter.chen@nxp.com>; linux- > >usb@vger.kernel.org; linux-kernel@vger.kernel.org > >Subject: RE: [PATCH] usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init() > > > >> > >>In cdnsp_endpoint_init(), cdnsp_ring_alloc() is assigned to pep->ring > >>and there is a dereference of it in cdnsp_endpoint_init(), which could > >>lead to a NULL pointer dereference on failure of cdnsp_ring_alloc(). > >> > >>Fix this bug by adding a check of pep->ring. > >> > >>This bug was found by a static analyzer. The analysis employs > >>differential checking to identify inconsistent security operations > >>(e.g., checks or kfrees) between two code paths and confirms that the > >>inconsistent operations are not recovered in the current function or > >>the callers, so they constitute bugs. > >> > >>Note that, as a bug found by static analysis, it can be a false > >>positive or hard to trigger. Multiple researchers have cross-reviewed > >>the bug. > >> > >>Builds with CONFIG_USB_CDNSP_GADGET=y show no new warnings, > >>and our static analyzer no longer warns about this code. > >> > >>Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") > >>Signed-off-by: Zhou Qingyang <zhou1615@umn.edu> > >>--- > >> drivers/usb/cdns3/cdnsp-mem.c | 3 +++ > >> 1 file changed, 3 insertions(+) > >> > >>diff --git a/drivers/usb/cdns3/cdnsp-mem.c b/drivers/usb/cdns3/cdnsp-mem.c > >>index ad9aee3f1e39..97866bfb2da9 100644 > >>--- a/drivers/usb/cdns3/cdnsp-mem.c > >>+++ b/drivers/usb/cdns3/cdnsp-mem.c > >>@@ -987,6 +987,9 @@ int cdnsp_endpoint_init(struct cdnsp_device *pdev, > >> > >> /* Set up the endpoint ring. */ > >> pep->ring = cdnsp_ring_alloc(pdev, 2, ring_type, max_packet, mem_flags); > >>+ if (!pep->ring) > >>+ return -ENOMEM; > >>+ > >> pep->skip = false; > >> > >> /* Fill the endpoint context */ > >>-- > >>2.25.1 > > > > > >Acked-by: Pawel Laszczak <pawell@cadence.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
> > > >-- > > > >Thanks, > >Pawel Laszczak
--
Thanks, Peter Chen
| |