From: Pawel Laszczak <pawell@cadence.com>
To: Zhou Qingyang <zhou1615@umn.edu>
Cc: "kjlu@umn.edu" <kjlu@umn.edu>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Peter Chen <peter.chen@nxp.com>,
"linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH] usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init()
Date: Wed, 1 Dec 2021 07:28:06 +0000 [thread overview]
Message-ID: <BYAPR07MB5381BE5297FA4905E8BD40C0DD689@BYAPR07MB5381.namprd07.prod.outlook.com> (raw)
In-Reply-To: <20211130172700.206650-1-zhou1615@umn.edu>
>
>In cdnsp_endpoint_init(), cdnsp_ring_alloc() is assigned to pep->ring
>and there is a dereference of it in cdnsp_endpoint_init(), which could
>lead to a NULL pointer dereference on failure of cdnsp_ring_alloc().
>
>Fix this bug by adding a check of pep->ring.
>
>This bug was found by a static analyzer. The analysis employs
>differential checking to identify inconsistent security operations
>(e.g., checks or kfrees) between two code paths and confirms that the
>inconsistent operations are not recovered in the current function or
>the callers, so they constitute bugs.
>
>Note that, as a bug found by static analysis, it can be a false
>positive or hard to trigger. Multiple researchers have cross-reviewed
>the bug.
>
>Builds with CONFIG_USB_CDNSP_GADGET=y show no new warnings,
>and our static analyzer no longer warns about this code.
>
>Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
>Signed-off-by: Zhou Qingyang <zhou1615@umn.edu>
>---
> drivers/usb/cdns3/cdnsp-mem.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/drivers/usb/cdns3/cdnsp-mem.c b/drivers/usb/cdns3/cdnsp-mem.c
>index ad9aee3f1e39..97866bfb2da9 100644
>--- a/drivers/usb/cdns3/cdnsp-mem.c
>+++ b/drivers/usb/cdns3/cdnsp-mem.c
>@@ -987,6 +987,9 @@ int cdnsp_endpoint_init(struct cdnsp_device *pdev,
>
> /* Set up the endpoint ring. */
> pep->ring = cdnsp_ring_alloc(pdev, 2, ring_type, max_packet, mem_flags);
>+ if (!pep->ring)
>+ return -ENOMEM;
>+
> pep->skip = false;
>
> /* Fill the endpoint context */
>--
>2.25.1
Acked-by: Pawel Laszczak <pawell@cadence.com>
--
Thanks,
Pawel Laszczak
next prev parent reply other threads:[~2021-12-01 7:28 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-30 17:27 [PATCH] usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init() Zhou Qingyang
2021-12-01 7:28 ` Pawel Laszczak [this message]
2021-12-01 7:39 ` Pawel Laszczak
2021-12-01 14:16 ` Peter Chen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=BYAPR07MB5381BE5297FA4905E8BD40C0DD689@BYAPR07MB5381.namprd07.prod.outlook.com \
--to=pawell@cadence.com \
--cc=gregkh@linuxfoundation.org \
--cc=kjlu@umn.edu \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=peter.chen@nxp.com \
--cc=zhou1615@umn.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).