From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.4 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C5E65C433FE for ; Thu, 9 Sep 2021 12:49:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A903B611CC for ; Thu, 9 Sep 2021 12:49:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353629AbhIIMtK (ORCPT ); Thu, 9 Sep 2021 08:49:10 -0400 Received: from mail.kernel.org ([198.145.29.99]:60536 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353009AbhIIMnF (ORCPT ); Thu, 9 Sep 2021 08:43:05 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 3AE5161373; Thu, 9 Sep 2021 11:55:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1631188530; bh=jLUQ1CvSAsfGGbAHf8ONc8i1Cp+aV+Ji4h/vvvknEEI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Lm+V+9SinczezfmMnD9jQEMjhU0lrop9Y7Iz2VL019GzJHNIPnZa4yfkOkQXi1I0c V2TqbpFrO5qSMBu1MpMRMwD/CzaUCUp3EyaNsRmkdTwXQyCfGkytA8PvsB7bvSZ5tH EW5S04Zb1peK419283ASo3E0IqS5LlFziBTOzwn7GEe+UdZ0At1tB5IXp+kf4pjDtr 124KlncPzWUrzYQH2L6lj9eT72RarVvi8YfZMy6sZGGFO02jHPx3I9vjUJC7jNdomr SO5ntRFDJxgnc9H7zsgzHLr8EOF5viJwfnEsAmRbwrkA8Jd1VskmQC9ppzC6yJTkmh SnLTtbS7IbiYg== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= , Brooke Basile , "Bryan O'Donoghue" , Felipe Balbi , Greg Kroah-Hartman , Lorenzo Colitti , Sasha Levin , linux-usb@vger.kernel.org Subject: [PATCH AUTOSEL 5.4 018/109] usb: gadget: u_ether: fix a potential null pointer dereference Date: Thu, 9 Sep 2021 07:53:35 -0400 Message-Id: <20210909115507.147917-18-sashal@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210909115507.147917-1-sashal@kernel.org> References: <20210909115507.147917-1-sashal@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org From: Maciej Żenczykowski [ Upstream commit 8ae01239609b29ec2eff55967c8e0fe3650cfa09 ] f_ncm tx timeout can call us with null skb to flush a pending frame. In this case skb is NULL to begin with but ceases to be null after dev->wrap() completes. In such a case in->maxpacket will be read, even though we've failed to check that 'in' is not NULL. Though I've never observed this fail in practice, however the 'flush operation' simply does not make sense with a null usb IN endpoint - there's nowhere to flush to... (note that we're the gadget/device, and IN is from the point of view of the host, so here IN actually means outbound...) Cc: Brooke Basile Cc: "Bryan O'Donoghue" Cc: Felipe Balbi Cc: Greg Kroah-Hartman Cc: Lorenzo Colitti Signed-off-by: Maciej Żenczykowski Link: https://lore.kernel.org/r/20210701114834.884597-6-zenczykowski@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/usb/gadget/function/u_ether.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c index 99b840daf3d9..57da62e33184 100644 --- a/drivers/usb/gadget/function/u_ether.c +++ b/drivers/usb/gadget/function/u_ether.c @@ -491,8 +491,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, } spin_unlock_irqrestore(&dev->lock, flags); - if (skb && !in) { - dev_kfree_skb_any(skb); + if (!in) { + if (skb) + dev_kfree_skb_any(skb); return NETDEV_TX_OK; } -- 2.30.2