usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init() - linux-dev - Linux kernel development work

diff options

author	Zhou Qingyang <zhou1615@umn.edu>	2021-12-01 01:27:00 +0800
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-03 13:57:45 +0100
commit	37307f7020ab38dde0892a578249bf63d00bca64 (patch)
tree	21395bf78fe9e155fddc60e646ab900da20ed097 /Documentation/userspace-api/ioctl/git:/ssh:/git@git.zx2c4.com
parent	usb: cdns3: gadget: fix new urb never complete if ep cancel previous requests (diff)

usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init()

In cdnsp_endpoint_init(), cdnsp_ring_alloc() is assigned to pep->ring and there is a dereference of it in cdnsp_endpoint_init(), which could lead to a NULL pointer dereference on failure of cdnsp_ring_alloc(). Fix this bug by adding a check of pep->ring. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_USB_CDNSP_GADGET=y show no new warnings, and our static analyzer no longer warns about this code. Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") Cc: stable <stable@vger.kernel.org> Acked-by: Pawel Laszczak <pawell@cadence.com> Acked-by: Peter Chen <peter.chen@kernel.org> Signed-off-by: Zhou Qingyang <zhou1615@umn.edu> Link: https://lore.kernel.org/r/20211130172700.206650-1-zhou1615@umn.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Diffstat (limited to 'Documentation/userspace-api/ioctl/git:/ssh:/git@git.zx2c4.com')

0 files changed, 0 insertions, 0 deletions

/* * Copyright © 2016 Intel Corporation * * Permission is hereby granted, free of charge, to any person obtaining a * copy of this software and associated documentation files (the "Software"), * to deal in the Software without restriction, including without limitation * the rights to use, copy, modify, merge, publish, distribute, sublicense, * and/or sell copies of the Software, and to permit persons to whom the * Software is furnished to do so, subject to the following conditions: * * The above copyright notice and this permission notice shall be included in * all copies or substantial portions of the Software. * * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR * OTHER DEALINGS IN THE SOFTWARE. */ /* * This header file contains mode setting related functions and definitions * which are only used within the drm kms helper module as internal * implementation details and are not exported to drivers. */ #include <drm/drm_dp_helper.h> /* drm_fb_helper.c */ #ifdef CONFIG_DRM_FBDEV_EMULATION int drm_fb_helper_modinit(void); #else static inline int drm_fb_helper_modinit(void) { return 0; } #endif /* drm_dp_aux_dev.c */ #ifdef CONFIG_DRM_DP_AUX_CHARDEV int drm_dp_aux_dev_init(void); void drm_dp_aux_dev_exit(void); int drm_dp_aux_register_devnode(struct drm_dp_aux *aux); void drm_dp_aux_unregister_devnode(struct drm_dp_aux *aux); #else static inline int drm_dp_aux_dev_init(void) { return 0; } static inline void drm_dp_aux_dev_exit(void) { } static inline int drm_dp_aux_register_devnode(struct drm_dp_aux *aux) { return 0; } static inline void drm_dp_aux_unregister_devnode(struct drm_dp_aux *aux) { } #endif


context:
space:
mode: