From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Evgeny Novikov <novikov@ispras.ru>,
Pavel Andrianov <andrianov@ispras.ru>,
Felipe Balbi <balbi@kernel.org>, Sasha Levin <sashal@kernel.org>,
linux-usb@vger.kernel.org
Subject: [PATCH AUTOSEL 5.4 05/42] usb: gadget: goku_udc: fix potential crashes in probe
Date: Mon, 9 Nov 2020 22:54:03 -0500 [thread overview]
Message-ID: <20201110035440.424258-5-sashal@kernel.org> (raw)
In-Reply-To: <20201110035440.424258-1-sashal@kernel.org>
From: Evgeny Novikov <novikov@ispras.ru>
[ Upstream commit 0d66e04875c5aae876cf3d4f4be7978fa2b00523 ]
goku_probe() goes to error label "err" and invokes goku_remove()
in case of failures of pci_enable_device(), pci_resource_start()
and ioremap(). goku_remove() gets a device from
pci_get_drvdata(pdev) and works with it without any checks, in
particular it dereferences a corresponding pointer. But
goku_probe() did not set this device yet. So, one can expect
various crashes. The patch moves setting the device just after
allocation of memory for it.
Found by Linux Driver Verification project (linuxtesting.org).
Reported-by: Pavel Andrianov <andrianov@ispras.ru>
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/udc/goku_udc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/udc/goku_udc.c b/drivers/usb/gadget/udc/goku_udc.c
index c3721225b61ed..b706ad3034bc1 100644
--- a/drivers/usb/gadget/udc/goku_udc.c
+++ b/drivers/usb/gadget/udc/goku_udc.c
@@ -1757,6 +1757,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
goto err;
}
+ pci_set_drvdata(pdev, dev);
spin_lock_init(&dev->lock);
dev->pdev = pdev;
dev->gadget.ops = &goku_ops;
@@ -1790,7 +1791,6 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
}
dev->regs = (struct goku_udc_regs __iomem *) base;
- pci_set_drvdata(pdev, dev);
INFO(dev, "%s\n", driver_desc);
INFO(dev, "version: " DRIVER_VERSION " %s\n", dmastr());
INFO(dev, "irq %d, pci mem %p\n", pdev->irq, base);
--
2.27.0
next prev parent reply other threads:[~2020-11-10 4:03 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-10 3:53 [PATCH AUTOSEL 5.4 01/42] ASoC: qcom: sdm845: set driver name correctly Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 02/42] ASoC: cs42l51: manage mclk shutdown delay Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 03/42] usb: dwc3: pci: add support for the Intel Alder Lake-S Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 04/42] opp: Reduce the size of critical section in _opp_table_kref_release() Sasha Levin
2020-11-10 3:54 ` Sasha Levin [this message]
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 06/42] selftests/ftrace: check for do_sys_openat2 in user-memory test Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 07/42] selftests: pidfd: fix compilation errors due to wait.h Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 08/42] ALSA: hda: Separate runtime and system suspend Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 09/42] ALSA: hda: Reinstate runtime_allow() for all hda controllers Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 10/42] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 11/42] gfs2: Add missing truncate_inode_pages_final for sd_aspace Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 12/42] gfs2: check for live vs. read-only file system in gfs2_fitrim Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 13/42] scsi: hpsa: Fix memory leak in hpsa_init_one() Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 14/42] drm/amdgpu: perform srbm soft reset always on SDMA resume Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 15/42] drm/amd/pm: perform SMC reset on suspend/hibernation Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 16/42] drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 17/42] mac80211: fix use of skb payload instead of header Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 18/42] cfg80211: initialize wdev data earlier Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 19/42] mac80211: always wind down STA state Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 20/42] cfg80211: regulatory: Fix inconsistent format argument Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 21/42] tracing: Fix the checking of stackidx in __ftrace_trace_stack Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 22/42] scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 23/42] scsi: mpt3sas: Fix timeouts observed while reenabling IRQ Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 24/42] nvme: introduce nvme_sync_io_queues Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 25/42] nvme-rdma: avoid race between time out and tear down Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 26/42] nvme-tcp: " Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 27/42] nvme-rdma: avoid repeated request completion Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 28/42] nvme-tcp: " Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 29/42] iommu/amd: Increase interrupt remapping table limit to 512 entries Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 30/42] s390/smp: move rcu_cpu_starting() earlier Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 31/42] vfio: platform: fix reference leak in vfio_platform_open Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 32/42] vfio/pci: Bypass IGD init in case of -ENODEV Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 33/42] i2c: mediatek: move dma reset before i2c reset Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 34/42] net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 35/42] amd/amdgpu: Disable VCN DPG mode for Picasso Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 36/42] kprobes: Tell lockdep about kprobe nesting Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 37/42] selftests: proc: fix warning: _GNU_SOURCE redefined Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 38/42] riscv: Set text_offset correctly for M-Mode Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 39/42] i2c: sh_mobile: implement atomic transfers Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 40/42] tpm_tis: Disable interrupts on ThinkPad T490s Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 41/42] vt: Disable KD_FONT_OP_COPY Sasha Levin
2020-11-10 3:54 ` [PATCH AUTOSEL 5.4 42/42] fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201110035440.424258-5-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=andrianov@ispras.ru \
--cc=balbi@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=novikov@ispras.ru \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).