diff options
| author |   Nobuo Iwata <nobuo.iwata@fujixerox.co.jp> | 2016-10-13 12:49:02 +0900 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-11-12 19:15:53 +0100 |
| commit | d43b763e7b7ec835c95bbd7624288ad80e48c92f (patch) | |
| tree | 4dc4495ce7770e120a548d8cb905cf7e98108c1b /drivers | |
| parent | usbip: Fix vhci_urb_enqueue() URB null transfer buffer error path (diff) | |
| download | linux-stable-d43b763e7b7ec835c95bbd7624288ad80e48c92f.tar.xz linux-stable-d43b763e7b7ec835c95bbd7624288ad80e48c92f.zip | |
usbip: fix possibility of dereference by NULLL pointer in vhci_hcd.c
commit d79cda045e3bacb7e754a5324cd3d4ce80708eb1 upstream.
This patch fixes possibility of dereference by NULLL pointer in "[PATCH
v5 1/3] usbip: vhci extension: modifications to vhci driver" which has
been merged to 4.9-rc1. It occurs when a URB with pointer to invalid
USB/IP device is enqueued in race condition against detach operation.
A pointer was passed to vdev_to_vhci() before NULL check.
In vdev_to_vhci(), there's a dereference by the pointer.
This patch moves vdev_to_vhci() after NULL check of the pointer.
Signed-off-by: Nobuo Iwata <nobuo.iwata@fujixerox.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/usbip/vhci_hcd.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c index ae2f56689537..5108ca50b2e6 100644 --- a/drivers/usb/usbip/vhci_hcd.c +++ b/drivers/usb/usbip/vhci_hcd.c @@ -465,13 +465,14 @@ static void vhci_tx_urb(struct urb *urb) { struct vhci_device *vdev = get_vdev(urb->dev); struct vhci_priv *priv; - struct vhci_hcd *vhci = vdev_to_vhci(vdev); + struct vhci_hcd *vhci; unsigned long flags; if (!vdev) { pr_err("could not get virtual device"); return; } + vhci = vdev_to_vhci(vdev); priv = kzalloc(sizeof(struct vhci_priv), GFP_ATOMIC); if (!priv) { |