[PATCH v3] staging: emxx_udc: Add checks for dma_alloc_coherent()

[PATCH v3] staging: emxx_udc: Add checks for dma_alloc_coherent()

[Yuan Can]

As the dma_alloc_coherent may return NULL, the return value needs to be
checked to avoid NULL poineter dereference.

Fixes: 33aa8d45a4fe ("staging: emxx_udc: Add Emma Mobile USB Gadget driver")
Signed-off-by: Yuan Can <yuancan@huawei.com>
---
changes in v2:
- do the null pointer check right before the memcpy().
changes in v3:
- do the null pointer check right after the dma_alloc_coherent().

 drivers/staging/emxx_udc/emxx_udc.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/emxx_udc/emxx_udc.c b/drivers/staging/emxx_udc/emxx_udc.c
index b4e19174bef2..f9765841c4aa 100644
--- a/drivers/staging/emxx_udc/emxx_udc.c
+++ b/drivers/staging/emxx_udc/emxx_udc.c
@@ -2587,10 +2587,15 @@ static int nbu2ss_ep_queue(struct usb_ep *_ep,
 		req->unaligned = false;
 
 	if (req->unaligned) {
-		if (!ep->virt_buf)
+		if (!ep->virt_buf) {
 			ep->virt_buf = dma_alloc_coherent(udc->dev, PAGE_SIZE,
 							  &ep->phys_buf,
 							  GFP_ATOMIC | GFP_DMA);
+			if (!ep->virt_buf) {
+				spin_unlock_irqrestore(&udc->lock, flags);
+				return -ENOMEM;
+			}
+		}
 		if (ep->epnum > 0)  {
 			if (ep->direct == USB_DIR_IN)
 				memcpy(ep->virt_buf, req->req.buf,
-- 
2.17.1

Re: [PATCH v3] staging: emxx_udc: Add checks for dma_alloc_coherent()

[Simon Horman]

On Thu, Jan 19, 2023 at 08:31:19AM +0000, Yuan Can wrote:
> As the dma_alloc_coherent may return NULL, the return value needs to be
> checked to avoid NULL poineter dereference.
> 
> Fixes: 33aa8d45a4fe ("staging: emxx_udc: Add Emma Mobile USB Gadget driver")
> Signed-off-by: Yuan Can <yuancan@huawei.com>
> ---
> changes in v2:
> - do the null pointer check right before the memcpy().
> changes in v3:
> - do the null pointer check right after the dma_alloc_coherent().
> 
>  drivers/staging/emxx_udc/emxx_udc.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)

I am no longer associated with Renesas, as I was when the patch
that added this problem was accepted.

But, FWIIW,

Reviewed-by: Simon Horman <horms@verge.net.au>

> 
> diff --git a/drivers/staging/emxx_udc/emxx_udc.c b/drivers/staging/emxx_udc/emxx_udc.c
> index b4e19174bef2..f9765841c4aa 100644
> --- a/drivers/staging/emxx_udc/emxx_udc.c
> +++ b/drivers/staging/emxx_udc/emxx_udc.c
> @@ -2587,10 +2587,15 @@ static int nbu2ss_ep_queue(struct usb_ep *_ep,
>  		req->unaligned = false;
>  
>  	if (req->unaligned) {
> -		if (!ep->virt_buf)
> +		if (!ep->virt_buf) {
>  			ep->virt_buf = dma_alloc_coherent(udc->dev, PAGE_SIZE,
>  							  &ep->phys_buf,
>  							  GFP_ATOMIC | GFP_DMA);
> +			if (!ep->virt_buf) {
> +				spin_unlock_irqrestore(&udc->lock, flags);
> +				return -ENOMEM;
> +			}
> +		}
>  		if (ep->epnum > 0)  {
>  			if (ep->direct == USB_DIR_IN)
>  				memcpy(ep->virt_buf, req->req.buf,
> -- 
> 2.17.1
> 

Re: [PATCH v3] staging: emxx_udc: Add checks for dma_alloc_coherent()

[Greg KH]

On Thu, Jan 19, 2023 at 08:31:19AM +0000, Yuan Can wrote:
> As the dma_alloc_coherent may return NULL, the return value needs to be
> checked to avoid NULL poineter dereference.
> 
> Fixes: 33aa8d45a4fe ("staging: emxx_udc: Add Emma Mobile USB Gadget driver")

This really is not a "fix" as you will never hit this in real life.
I'll drop that tag.

> Signed-off-by: Yuan Can <yuancan@huawei.com>
> ---
> changes in v2:
> - do the null pointer check right before the memcpy().
> changes in v3:
> - do the null pointer check right after the dma_alloc_coherent().
> 
>  drivers/staging/emxx_udc/emxx_udc.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/emxx_udc/emxx_udc.c b/drivers/staging/emxx_udc/emxx_udc.c
> index b4e19174bef2..f9765841c4aa 100644
> --- a/drivers/staging/emxx_udc/emxx_udc.c
> +++ b/drivers/staging/emxx_udc/emxx_udc.c
> @@ -2587,10 +2587,15 @@ static int nbu2ss_ep_queue(struct usb_ep *_ep,
>  		req->unaligned = false;
>  
>  	if (req->unaligned) {
> -		if (!ep->virt_buf)
> +		if (!ep->virt_buf) {
>  			ep->virt_buf = dma_alloc_coherent(udc->dev, PAGE_SIZE,
>  							  &ep->phys_buf,
>  							  GFP_ATOMIC | GFP_DMA);

Wait, why is this asking for GFP_DMA memory?  That's probably a
different bug...

thanks,

greg k-h