[PATCH] usb: gadget: udc: handle NULL request in tracepoint

[PATCH] usb: gadget: udc: handle NULL request in tracepoint

[Liu Junyuan]

usb_ep_alloc_request() passes a NULL request to
trace_usb_ep_alloc_request() when ep->ops->alloc_request() fails.
The udc_log_req tracepoint assumes req is non-NULL and dereferences
req->length, causing a NULL pointer dereference.

Make the tracepoint handle req == NULL so allocation failures can still
be recorded safely.

Reported-by: syzbot+2a7ce560c30c4ca3bc22@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2a7ce560c30c4ca3bc22
Fixes: 5e42d710a108 ("usb: gadget: add tracepoints to the gadget API")
Signed-off-by: Liu Junyuan <2058432396@qq.com>
---
 drivers/usb/gadget/udc/trace.h | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/drivers/usb/gadget/udc/trace.h b/drivers/usb/gadget/udc/trace.h
index fa3e6ddf0a12..bcf89b5693db 100644
--- a/drivers/usb/gadget/udc/trace.h
+++ b/drivers/usb/gadget/udc/trace.h
@@ -239,15 +239,27 @@ DECLARE_EVENT_CLASS(udc_log_req,
 	),
 	TP_fast_assign(
 		__assign_str(name);
-		__entry->length = req->length;
-		__entry->actual = req->actual;
-		__entry->num_sgs = req->num_sgs;
-		__entry->num_mapped_sgs = req->num_mapped_sgs;
-		__entry->stream_id = req->stream_id;
-		__entry->no_interrupt = req->no_interrupt;
-		__entry->zero = req->zero;
-		__entry->short_not_ok = req->short_not_ok;
-		__entry->status = req->status;
+		if (req) {
+			__entry->length = req->length;
+			__entry->actual = req->actual;
+			__entry->num_sgs = req->num_sgs;
+			__entry->num_mapped_sgs = req->num_mapped_sgs;
+			__entry->stream_id = req->stream_id;
+			__entry->no_interrupt = req->no_interrupt;
+			__entry->zero = req->zero;
+			__entry->short_not_ok = req->short_not_ok;
+			__entry->status = req->status;
+		} else {
+			__entry->length = 0;
+			__entry->actual = 0;
+			__entry->num_sgs = 0;
+			__entry->num_mapped_sgs = 0;
+			__entry->stream_id = 0;
+			__entry->no_interrupt = 0;
+			__entry->zero = 0;
+			__entry->short_not_ok = 0;
+			__entry->status = 0;
+		}
 		__entry->ret = ret;
 		__entry->req = req;
 	),
-- 
2.43.0

Re: [PATCH] usb: gadget: udc: handle NULL request in tracepoint

[sashiko-bot]

> usb_ep_alloc_request() passes a NULL request to
> trace_usb_ep_alloc_request() when ep->ops->alloc_request() fails.
> The udc_log_req tracepoint assumes req is non-NULL and dereferences
> req->length, causing a NULL pointer dereference.
> 
> Make the tracepoint handle req == NULL so allocation failures can still
> be recorded safely.
> 
> Reported-by: syzbot+2a7ce560c30c4ca3bc22@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=2a7ce560c30c4ca3bc22
> Fixes: 5e42d710a108 ("usb: gadget: add tracepoints to the gadget API")
> Signed-off-by: Liu Junyuan <2058432396@qq.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/tencent_08E401ED34EC47C550C71A0462C8161D5D05@qq.com?part=1

[PATCH] usb: gadget: udc: handle NULL request in tracepoint

[LiuJunyuan]

usb_ep_alloc_request() passes a NULL request to
trace_usb_ep_alloc_request() when ep->ops->alloc_request() fails.
The udc_log_req tracepoint assumes req is non-NULL and dereferences
req->length, causing a NULL pointer dereference.

Make the tracepoint handle req == NULL so allocation failures can still
be recorded safely.

Reported-by: syzbot+2a7ce560c30c4ca3bc22@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2a7ce560c30c4ca3bc22
Fixes: 5e42d710a108 ("usb: gadget: add tracepoints to the gadget API")
Signed-off-by: LiuJunyuan <2058432396@qq.com>
---
 drivers/usb/gadget/udc/trace.h | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/drivers/usb/gadget/udc/trace.h b/drivers/usb/gadget/udc/trace.h
index fa3e6ddf0a12..bcf89b5693db 100644
--- a/drivers/usb/gadget/udc/trace.h
+++ b/drivers/usb/gadget/udc/trace.h
@@ -239,15 +239,27 @@ DECLARE_EVENT_CLASS(udc_log_req,
 	),
 	TP_fast_assign(
 		__assign_str(name);
-		__entry->length = req->length;
-		__entry->actual = req->actual;
-		__entry->num_sgs = req->num_sgs;
-		__entry->num_mapped_sgs = req->num_mapped_sgs;
-		__entry->stream_id = req->stream_id;
-		__entry->no_interrupt = req->no_interrupt;
-		__entry->zero = req->zero;
-		__entry->short_not_ok = req->short_not_ok;
-		__entry->status = req->status;
+		if (req) {
+			__entry->length = req->length;
+			__entry->actual = req->actual;
+			__entry->num_sgs = req->num_sgs;
+			__entry->num_mapped_sgs = req->num_mapped_sgs;
+			__entry->stream_id = req->stream_id;
+			__entry->no_interrupt = req->no_interrupt;
+			__entry->zero = req->zero;
+			__entry->short_not_ok = req->short_not_ok;
+			__entry->status = req->status;
+		} else {
+			__entry->length = 0;
+			__entry->actual = 0;
+			__entry->num_sgs = 0;
+			__entry->num_mapped_sgs = 0;
+			__entry->stream_id = 0;
+			__entry->no_interrupt = 0;
+			__entry->zero = 0;
+			__entry->short_not_ok = 0;
+			__entry->status = 0;
+		}
 		__entry->ret = ret;
 		__entry->req = req;
 	),
-- 
2.43.0

Re: [PATCH] usb: gadget: udc: handle NULL request in tracepoint

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] usb: gadget: udc: single-word name in Signed-off-by trailer
--

commit 6804b1034e0597891cfe25f25e74344c3996cdb7
Author: LiuJunyuan <2058432396@qq.com>

> usb: gadget: udc: handle NULL request in tracepoint
>
> usb_ep_alloc_request() passes a NULL request to
> trace_usb_ep_alloc_request() when ep->ops->alloc_request() fails.
> The udc_log_req tracepoint assumes req is non-NULL and dereferences
> req->length, causing a NULL pointer dereference.
>
> Make the tracepoint handle req == NULL so allocation failures can still
> be recorded safely.
>
> Reported-by: syzbot+2a7ce560c30c4ca3bc22@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=2a7ce560c30c4ca3bc22
> Fixes: 5e42d710a108 ("usb: gadget: add tracepoints to the gadget API")
> Signed-off-by: LiuJunyuan <2058432396@qq.com>

[Severity: High]
The Author and Signed-off-by lines use a single-word name ("LiuJunyuan")
without a space between the family name and given name.  Per
Documentation/process/submitting-patches.rst, DCO sign-off requires a
space-separated full real name (e.g., "Liu Junyuan" or "Junyuan Liu").

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/tencent_924108DBAEA30F3DD09C66FEC41A965A970A@qq.com?part=1