From: Greg KH <gregkh@linuxfoundation.org>
To: Maxim Devaev <mdevaev@gmail.com>
Cc: balbi@kernel.org, sandeen@redhat.com, linux-usb@vger.kernel.org,
Phil Elwell <phil@raspberrypi.com>
Subject: Re: [PATCH v2] usb: gadget: f_hid: fixed NULL pointer dereference
Date: Fri, 23 Jul 2021 18:22:32 +0200 [thread overview]
Message-ID: <YPrsyBwKqcxI5uO0@kroah.com> (raw)
In-Reply-To: <20210723155928.210019-1-mdevaev@gmail.com>
On Fri, Jul 23, 2021 at 06:59:30PM +0300, Maxim Devaev wrote:
> From: Phil Elwell <phil@raspberrypi.com>
>
> Disconnecting and reconnecting the USB cable can lead to crashes
> and a variety of kernel log spam.
>
> The problem was found and reproduced on the Raspberry Pi [1]
> and the original fix was created in Raspberry's own fork [2].
>
> Signed-off-by: Maxim Devaev <mdevaev@gmail.com>
> Signed-off-by: Phil Elwell <phil@raspberrypi.com>
> Link: https://github.com/raspberrypi/linux/issues/3870 [1]
> Link: https://github.com/raspberrypi/linux/commit/a6e47d5f4efbd2ea6a0b6565cd2f9b7bb217ded5 [2]
> ---
> drivers/usb/gadget/function/f_hid.c | 26 ++++++++++++++++++++------
> 1 file changed, 20 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
> index 02683ac07..08e73e812 100644
> --- a/drivers/usb/gadget/function/f_hid.c
> +++ b/drivers/usb/gadget/function/f_hid.c
> @@ -338,6 +338,11 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
>
> spin_lock_irqsave(&hidg->write_spinlock, flags);
>
> + if (!hidg->req) {
> + spin_unlock_irqrestore(&hidg->write_spinlock, flags);
> + return -ESHUTDOWN;
> + }
> +
> #define WRITE_COND (!hidg->write_pending)
> try_again:
> /* write queue */
> @@ -358,8 +363,14 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
> count = min_t(unsigned, count, hidg->report_length);
>
> spin_unlock_irqrestore(&hidg->write_spinlock, flags);
> - status = copy_from_user(req->buf, buffer, count);
>
> + if (!req) {
> + ERROR(hidg->func.config->cdev, "hidg->req is NULL\n");
> + status = -ESHUTDOWN;
> + goto release_write_pending;
> + }
> +
> + status = copy_from_user(req->buf, buffer, count);
> if (status != 0) {
> ERROR(hidg->func.config->cdev,
> "copy_from_user error\n");
> @@ -387,14 +398,17 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
>
> spin_unlock_irqrestore(&hidg->write_spinlock, flags);
>
> + if (!hidg->in_ep->enabled) {
> + ERROR(hidg->func.config->cdev, "in_ep is disabled\n");
> + status = -ESHUTDOWN;
> + goto release_write_pending;
What prevents "enabled" from changing right after you test this? You do
not have the lock held so could it change then?
> + }
> +
> status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC);
> - if (status < 0) {
> - ERROR(hidg->func.config->cdev,
> - "usb_ep_queue error on int endpoint %zd\n", status);
> + if (status < 0)
> goto release_write_pending;
No error message if queueing up failed?
thanks,
greg k-h
next prev parent reply other threads:[~2021-07-23 16:23 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-23 15:59 [PATCH v2] usb: gadget: f_hid: fixed NULL pointer dereference Maxim Devaev
2021-07-23 16:22 ` Greg KH [this message]
2021-07-23 16:48 ` Maxim Devaev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YPrsyBwKqcxI5uO0@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=balbi@kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mdevaev@gmail.com \
--cc=phil@raspberrypi.com \
--cc=sandeen@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).