Forwarded: [PATCH] usb: gadget: net2280: fix NULL pointer deref in usb_reinit_338x()

[syzbot <syzbot+2ec7fc1793a63864d9d6@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] usb: gadget: net2280: fix NULL pointer deref in usb_reinit_338x()
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

net2280_probe() only maps dev->llregs when the PLX_PCIE quirk bit is
set. usb_reinit() dispatches to usb_reinit_338x() for any device that
doesn't have PLX_LEGACY set, assuming such a device must have
PLX_PCIE set (and thus llregs mapped). That assumption holds for
every entry in the driver's pci_device_id table, but a forced driver
bind (e.g. via sysfs bind/driver_override) can invoke probe() with
quirks that have neither bit set, leaving llregs NULL and crashing
in usb_reinit_338x() on the first readl().

Reject probe() early when quirks has neither PLX_LEGACY nor
PLX_PCIE set, instead of proceeding into a reinit path that assumes
one of them is always present.

Reported-by: syzbot+2ec7fc1793a63864d9d6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2ec7fc1793a63864d9d6
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/usb/gadget/udc/net2280.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
index 7c5f30cfd24d..02d12c2ad58b 100644
--- a/drivers/usb/gadget/udc/net2280.c
+++ b/drivers/usb/gadget/udc/net2280.c
@@ -3708,6 +3708,17 @@ static int net2280_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		writel(0, &dev->usb->usbctl);
 	}
 
+	/* usb_reinit() dispatches on PLX_LEGACY vs PLX_PCIE and assumes
+	 * every non-legacy chip has llregs mapped (PLX_PCIE branch above).
+	 * A forced/mismatched driver bind can hand us quirks that satisfy
+         * neither, so refuse to proceed rather than dereference NULL.
+         */
+	if (!(dev->quirks & (PLX_LEGACY | PLX_PCIE))) {
+		ep_err(dev, "unsupported device (quirks=%#lx)\n", dev->quirks);
+		retval = -ENODEV;
+		goto done;
+	}
+
 	usb_reset(dev);
 	usb_reinit(dev);
 
-- 
2.43.0