* [RFC PATCH] usb: gadget: composite: Fix NULL pointer dereference
@ 2015-06-11 16:42 Kishon Vijay Abraham I
0 siblings, 0 replies; only message in thread
From: Kishon Vijay Abraham I @ 2015-06-11 16:42 UTC (permalink / raw)
To: balbi, andrzej.p, nsekhar, linux-usb, linux-kernel; +Cc: gregkh, kishon
commit f563d230903210acc ("usb: gadget: composite: add req_match method
to usb_function") accesses cdev->config even before set config
is invoked causing a NULL pointer dereferencing error while running
Lecroy Mass Storage Compliance test.
Fix it here by accessing cdev->config only if it is non NULL.
Fixes: commit f563d230903210acc ("usb: gadget: composite: add req_match
method to usb_function").
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
---
Running Mass Storage Examples (TD.1.01 Interface Descriptor Test) in Lecroy
Compliance Suite produces this NULL pointer dereference abort.
The request is actually
"non-core control reqa0.06 v2a00 i0000 l12"
Tested this patch using USB3 Gen X CV (ch9 tests: usb2 and usb3,
link layer testing and MSC tests) and using USB2 X CV (ch9 tests,
MSC tests) and verified this doesn't cause any failures.
drivers/usb/gadget/composite.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 4e3447b..58b4657 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1758,10 +1758,13 @@ unknown:
* take such requests too, if that's ever needed: to work
* in config 0, etc.
*/
- list_for_each_entry(f, &cdev->config->functions, list)
- if (f->req_match && f->req_match(f, ctrl))
- goto try_fun_setup;
- f = NULL;
+ if (cdev->config) {
+ list_for_each_entry(f, &cdev->config->functions, list)
+ if (f->req_match && f->req_match(f, ctrl))
+ goto try_fun_setup;
+ f = NULL;
+ }
+
switch (ctrl->bRequestType & USB_RECIP_MASK) {
case USB_RECIP_INTERFACE:
if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
--
1.7.9.5
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2015-06-11 16:42 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-06-11 16:42 [RFC PATCH] usb: gadget: composite: Fix NULL pointer dereference Kishon Vijay Abraham I
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.