Re: [PATCH] usb: dwc2: host: Fix dereference issue in DDMA completion flow.

[Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>]

Hi Greg,

On 4/9/24 14:10, Greg Kroah-Hartman wrote:
> On Tue, Apr 09, 2024 at 10:06:32AM +0000, Minas Harutyunyan wrote:
>> Fixed variable dereference issue in DDMA completion flow.
> 
> What do you mean by this?
> 
>>
>> Fixes: b258e4268850 ("usb: dwc2: host: Fix ISOC flow in DDMA mode")
>> CC: stable@vger.kernel.org
>> Signed-off-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
> 
> Did someone report this problem?
> 
> thanks,
> 
> greg k-h
> 

Yes, it's reported by Dan Carpenter:

email on 4/5/24, 14:09
subject: [bug report] usb: dwc2: host: Fix ISOC flow in DDMA mode

Body:
Hello Minas Harutyunyan,

This is a semi-automatic email about new static checker warnings.

Commit b258e4268850 ("usb: dwc2: host: Fix ISOC flow in DDMA mode")
from Mar 13, 2024, leads to the following Smatch complaint:

     drivers/usb/dwc2/hcd_ddma.c:874 dwc2_cmpl_host_isoc_dma_desc()
     warn: variable dereferenced before check 'qtd->urb' (see line 870)

drivers/usb/dwc2/hcd_ddma.c
    869		u16 frame_desc_idx;
    870		struct urb *usb_urb = qtd->urb->priv;
                                       ^^^^^^^^^^
The patch adds a dereference

    871		u16 remain = 0;
    872		int rc = 0;
    873	
    874		if (!qtd->urb)
                     ^^^^^^^^^
The existing check is too late now

    875			return -EINVAL;
    876	

regards,
dan carpenter