[PATCH] xhci: host: potential NULL dereference in xhci_generic_plat_probe()

[PATCH] xhci: host: potential NULL dereference in xhci_generic_plat_probe()

[Dan Carpenter]

It's possible to exit the loop with "sysdev" set to NULL.  In that
case we should use "&pdev->dev".

Fixes: ec5499d338ec ("xhci: split out rcar/rz support from xhci-plat.c")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
 drivers/usb/host/xhci-plat.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index cd17ccab6e00..b9f9625467d6 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -368,6 +368,9 @@ static int xhci_generic_plat_probe(struct platform_device *pdev)
 #endif
 	}
 
+	if (!sysdev)
+		sysdev = &pdev->dev;
+
 	if (WARN_ON(!sysdev->dma_mask)) {
 		/* Platform did not initialize dma_mask */
 		ret = dma_coerce_mask_and_coherent(sysdev, DMA_BIT_MASK(64));
-- 
2.35.1

Re: [PATCH] xhci: host: potential NULL dereference in xhci_generic_plat_probe()

[Arnd Bergmann]

On Thu, Feb 9, 2023, at 14:43, Dan Carpenter wrote:
> It's possible to exit the loop with "sysdev" set to NULL.  In that
> case we should use "&pdev->dev".
>
> Fixes: ec5499d338ec ("xhci: split out rcar/rz support from xhci-plat.c")
> Signed-off-by: Dan Carpenter <error27@gmail.com>

Thanks for the fix!

I think this doesn't happen in practice because the loop should
always find a firmware or PCI owned device, but it is clearly better
to keep the original behavior from before my patch to be on the
safe side here.

Acked-by: Arnd Bergmann <arnd@arndb.de>


>  drivers/usb/host/xhci-plat.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
> index cd17ccab6e00..b9f9625467d6 100644
> --- a/drivers/usb/host/xhci-plat.c
> +++ b/drivers/usb/host/xhci-plat.c
> @@ -368,6 +368,9 @@ static int xhci_generic_plat_probe(struct 
> platform_device *pdev)
>  #endif
>  	}
> 
> +	if (!sysdev)
> +		sysdev = &pdev->dev;
> +
>  	if (WARN_ON(!sysdev->dma_mask)) {
>  		/* Platform did not initialize dma_mask */
>  		ret = dma_coerce_mask_and_coherent(sysdev, DMA_BIT_MASK(64));