* usb: host: xhci_debugfs: Fix a null pointer dereference in xhci_debugfs_create_endpoint()
@ 2019-05-04 3:37 Jia-Ju Bai
2019-05-04 3:37 ` [PATCH] " Jia-Ju Bai
2019-05-04 6:33 ` Greg Kroah-Hartman
0 siblings, 2 replies; 7+ messages in thread
From: Jia-Ju Bai @ 2019-05-04 3:37 UTC (permalink / raw)
To: mathias.nyman, gregkh; +Cc: linux-usb, linux-kernel, Jia-Ju Bai
In xhci_debugfs_create_slot(), kzalloc() can fail and
dev->debugfs_private will be NULL.
In xhci_debugfs_create_endpoint(), dev->debugfs_private is used without
any null-pointer check, and can cause a null pointer dereference.
To fix this bug, a null-pointer check is added in
xhci_debugfs_create_endpoint().
This bug is found by a runtime fuzzing tool named FIZZER written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
---
drivers/usb/host/xhci-debugfs.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
index cadc01336bf8..7ba6afc7ef23 100644
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -440,6 +440,9 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci,
struct xhci_ep_priv *epriv;
struct xhci_slot_priv *spriv = dev->debugfs_private;
+ if (!spriv)
+ return;
+
if (spriv->eps[ep_index])
return;
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH] usb: host: xhci_debugfs: Fix a null pointer dereference in xhci_debugfs_create_endpoint()
2019-05-04 3:37 usb: host: xhci_debugfs: Fix a null pointer dereference in xhci_debugfs_create_endpoint() Jia-Ju Bai
@ 2019-05-04 3:37 ` Jia-Ju Bai
2019-05-04 6:33 ` Greg Kroah-Hartman
1 sibling, 0 replies; 7+ messages in thread
From: Jia-Ju Bai @ 2019-05-04 3:37 UTC (permalink / raw)
To: mathias.nyman, gregkh; +Cc: linux-usb, linux-kernel, Jia-Ju Bai
In xhci_debugfs_create_slot(), kzalloc() can fail and
dev->debugfs_private will be NULL.
In xhci_debugfs_create_endpoint(), dev->debugfs_private is used without
any null-pointer check, and can cause a null pointer dereference.
To fix this bug, a null-pointer check is added in
xhci_debugfs_create_endpoint().
This bug is found by a runtime fuzzing tool named FIZZER written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
---
drivers/usb/host/xhci-debugfs.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
index cadc01336bf8..7ba6afc7ef23 100644
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -440,6 +440,9 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci,
struct xhci_ep_priv *epriv;
struct xhci_slot_priv *spriv = dev->debugfs_private;
+ if (!spriv)
+ return;
+
if (spriv->eps[ep_index])
return;
--
2.17.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* usb: host: xhci_debugfs: Fix a null pointer dereference in xhci_debugfs_create_endpoint()
@ 2019-05-04 6:33 ` Greg Kroah-Hartman
2019-05-04 6:33 ` [PATCH] " Greg KH
2019-05-04 7:30 ` Jia-Ju Bai
0 siblings, 2 replies; 7+ messages in thread
From: Greg Kroah-Hartman @ 2019-05-04 6:33 UTC (permalink / raw)
To: Jia-Ju Bai; +Cc: mathias.nyman, linux-usb, linux-kernel
On Sat, May 04, 2019 at 11:37:48AM +0800, Jia-Ju Bai wrote:
> In xhci_debugfs_create_slot(), kzalloc() can fail and
> dev->debugfs_private will be NULL.
> In xhci_debugfs_create_endpoint(), dev->debugfs_private is used without
> any null-pointer check, and can cause a null pointer dereference.
>
> To fix this bug, a null-pointer check is added in
> xhci_debugfs_create_endpoint().
>
> This bug is found by a runtime fuzzing tool named FIZZER written by us.
>
> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Very rare case, but nice fix. You should put "potential" in your
subject line as this is something that no one should ever hit :)
Anyway:
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] usb: host: xhci_debugfs: Fix a null pointer dereference in xhci_debugfs_create_endpoint()
2019-05-04 6:33 ` Greg Kroah-Hartman
@ 2019-05-04 6:33 ` Greg KH
2019-05-04 7:30 ` Jia-Ju Bai
1 sibling, 0 replies; 7+ messages in thread
From: Greg KH @ 2019-05-04 6:33 UTC (permalink / raw)
To: Jia-Ju Bai; +Cc: mathias.nyman, linux-usb, linux-kernel
On Sat, May 04, 2019 at 11:37:48AM +0800, Jia-Ju Bai wrote:
> In xhci_debugfs_create_slot(), kzalloc() can fail and
> dev->debugfs_private will be NULL.
> In xhci_debugfs_create_endpoint(), dev->debugfs_private is used without
> any null-pointer check, and can cause a null pointer dereference.
>
> To fix this bug, a null-pointer check is added in
> xhci_debugfs_create_endpoint().
>
> This bug is found by a runtime fuzzing tool named FIZZER written by us.
>
> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Very rare case, but nice fix. You should put "potential" in your
subject line as this is something that no one should ever hit :)
Anyway:
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
^ permalink raw reply [flat|nested] 7+ messages in thread
* usb: host: xhci_debugfs: Fix a null pointer dereference in xhci_debugfs_create_endpoint()
@ 2019-05-04 7:30 ` Jia-Ju Bai
2019-05-04 7:30 ` [PATCH] " Jia-Ju Bai
2019-05-06 11:16 ` Mathias Nyman
0 siblings, 2 replies; 7+ messages in thread
From: Jia-Ju Bai @ 2019-05-04 7:30 UTC (permalink / raw)
To: Greg KH; +Cc: mathias.nyman, linux-usb, linux-kernel
On 2019/5/4 14:33, Greg KH wrote:
> On Sat, May 04, 2019 at 11:37:48AM +0800, Jia-Ju Bai wrote:
>> In xhci_debugfs_create_slot(), kzalloc() can fail and
>> dev->debugfs_private will be NULL.
>> In xhci_debugfs_create_endpoint(), dev->debugfs_private is used without
>> any null-pointer check, and can cause a null pointer dereference.
>>
>> To fix this bug, a null-pointer check is added in
>> xhci_debugfs_create_endpoint().
>>
>> This bug is found by a runtime fuzzing tool named FIZZER written by us.
>>
>> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
> Very rare case, but nice fix. You should put "potential" in your
> subject line as this is something that no one should ever hit :)
Okay, Greg, thanks for this advice :)
Best wishes,
Jia-Ju Bai
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] usb: host: xhci_debugfs: Fix a null pointer dereference in xhci_debugfs_create_endpoint()
2019-05-04 7:30 ` Jia-Ju Bai
@ 2019-05-04 7:30 ` Jia-Ju Bai
2019-05-06 11:16 ` Mathias Nyman
1 sibling, 0 replies; 7+ messages in thread
From: Jia-Ju Bai @ 2019-05-04 7:30 UTC (permalink / raw)
To: Greg KH; +Cc: mathias.nyman, linux-usb, linux-kernel
On 2019/5/4 14:33, Greg KH wrote:
> On Sat, May 04, 2019 at 11:37:48AM +0800, Jia-Ju Bai wrote:
>> In xhci_debugfs_create_slot(), kzalloc() can fail and
>> dev->debugfs_private will be NULL.
>> In xhci_debugfs_create_endpoint(), dev->debugfs_private is used without
>> any null-pointer check, and can cause a null pointer dereference.
>>
>> To fix this bug, a null-pointer check is added in
>> xhci_debugfs_create_endpoint().
>>
>> This bug is found by a runtime fuzzing tool named FIZZER written by us.
>>
>> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
> Very rare case, but nice fix. You should put "potential" in your
> subject line as this is something that no one should ever hit :)
Okay, Greg, thanks for this advice :)
Best wishes,
Jia-Ju Bai
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] usb: host: xhci_debugfs: Fix a null pointer dereference in xhci_debugfs_create_endpoint()
2019-05-04 7:30 ` Jia-Ju Bai
2019-05-04 7:30 ` [PATCH] " Jia-Ju Bai
@ 2019-05-06 11:16 ` Mathias Nyman
1 sibling, 0 replies; 7+ messages in thread
From: Mathias Nyman @ 2019-05-06 11:16 UTC (permalink / raw)
To: Jia-Ju Bai, Greg KH; +Cc: mathias.nyman, linux-usb, linux-kernel
On 4.5.2019 10.30, Jia-Ju Bai wrote:
>
>
> On 2019/5/4 14:33, Greg KH wrote:
>> On Sat, May 04, 2019 at 11:37:48AM +0800, Jia-Ju Bai wrote:
>>> In xhci_debugfs_create_slot(), kzalloc() can fail and
>>> dev->debugfs_private will be NULL.
>>> In xhci_debugfs_create_endpoint(), dev->debugfs_private is used without
>>> any null-pointer check, and can cause a null pointer dereference.
>>>
>>> To fix this bug, a null-pointer check is added in
>>> xhci_debugfs_create_endpoint().
>>>
>>> This bug is found by a runtime fuzzing tool named FIZZER written by us.
>>>
>>> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
>> Very rare case, but nice fix. You should put "potential" in your
>> subject line as this is something that no one should ever hit :)
>
> Okay, Greg, thanks for this advice :)
>
Adding patch to queue, and added "potential" to subject line.
-Mathias
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2019-05-06 11:14 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-05-04 3:37 usb: host: xhci_debugfs: Fix a null pointer dereference in xhci_debugfs_create_endpoint() Jia-Ju Bai
2019-05-04 3:37 ` [PATCH] " Jia-Ju Bai
2019-05-04 6:33 ` Greg Kroah-Hartman
2019-05-04 6:33 ` [PATCH] " Greg KH
2019-05-04 7:30 ` Jia-Ju Bai
2019-05-04 7:30 ` [PATCH] " Jia-Ju Bai
2019-05-06 11:16 ` Mathias Nyman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).