[PATCH] usb: usbip: fix null pointer dereference

[PATCH] usb: usbip: fix null pointer dereference

[Sudip Mukherjee]

We have been dereferencing udc before checking it. Lets use it after it
has been checked.

Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
---
 drivers/usb/usbip/vudc_sysfs.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
index 99397fa..0ba6a06 100644
--- a/drivers/usb/usbip/vudc_sysfs.c
+++ b/drivers/usb/usbip/vudc_sysfs.c
@@ -35,14 +35,17 @@
 int get_gadget_descs(struct vudc *udc)
 {
 	struct vrequest *usb_req;
-	struct vep *ep0 = to_vep(udc->gadget.ep0);
-	struct usb_device_descriptor *ddesc = &udc->dev_desc;
+	struct vep *ep0;
+	struct usb_device_descriptor *ddesc;
 	struct usb_ctrlrequest req;
 	int ret;
 
 	if (!udc || !udc->driver || !udc->pullup)
 		return -EINVAL;
 
+	ep0 = to_vep(udc->gadget.ep0);
+	ddesc = &udc->dev_desc;
+
 	req.bRequestType = USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_DEVICE;
 	req.bRequest = USB_REQ_GET_DESCRIPTOR;
 	req.wValue = cpu_to_le16(USB_DT_DEVICE << 8);
-- 
1.9.1

Re: [PATCH] usb: usbip: fix null pointer dereference

[Krzysztof Opasiak]

On 06/02/2016 03:22 PM, Sudip Mukherjee wrote:
> We have been dereferencing udc before checking it. Lets use it after it
> has been checked.
> 

To be honest I have mixed feelings about this patch.

On one hand it prevents us from dereferencing potential NULL ptr what is
generally good. But on the other hand it seems to be a little bit
pointless overhead. This function is called only in one place, it's
internal function of vudc driver and in addition generally it is
currently impossible that this function will get NULL ptr as parameter
as it's value is taken from container_of(). Not to mention that if this
is NULL or garbage we will end up in NULL ptr dereference much earlier
before calling this function.

So if there is something that you would like to fix with this patch and
you have a real problem with this function could you please provide us
some more details (for example stack trace)? If this patch is just to
prevent us from something that will never happen then I would rather to
not submit this. In my opinion if we get a NULL in this function this
means that we have some serious problem in UDC core and this check will
just mask this error.

Best regards,
-- 
Krzysztof Opasiak
Samsung R&D Institute Poland
Samsung Electronics

Re: [PATCH] usb: usbip: fix null pointer dereference

[Alan Stern]

On Fri, 3 Jun 2016, Krzysztof Opasiak wrote:

> On 06/02/2016 03:22 PM, Sudip Mukherjee wrote:
> > We have been dereferencing udc before checking it. Lets use it after it
> > has been checked.
> > 
> 
> To be honest I have mixed feelings about this patch.
> 
> On one hand it prevents us from dereferencing potential NULL ptr what is
> generally good. But on the other hand it seems to be a little bit
> pointless overhead. This function is called only in one place, it's
> internal function of vudc driver and in addition generally it is
> currently impossible that this function will get NULL ptr as parameter
> as it's value is taken from container_of(). Not to mention that if this
> is NULL or garbage we will end up in NULL ptr dereference much earlier
> before calling this function.
> 
> So if there is something that you would like to fix with this patch and
> you have a real problem with this function could you please provide us
> some more details (for example stack trace)? If this patch is just to
> prevent us from something that will never happen then I would rather to
> not submit this. In my opinion if we get a NULL in this function this
> means that we have some serious problem in UDC core and this check will
> just mask this error.

Normally in this situation, somebody would write a patch that removes 
these lines from get_gadget_descs():

	if (!udc || !udc->driver || !udc->pullup)
		return -EINVAL;

Or maybe (I'm not familiar with the driver so I don't know the best 
approach) changes the test to:

	if (!udc->driver || !udc->pullup)

After all, there's no reason to check !udc if it is known beforehand 
that udc will never be NULL.

Alan Stern

Re: [PATCH] usb: usbip: fix null pointer dereference

[Sudip Mukherjee]

[-- Attachment #1: Type: text/plain, Size: 1430 bytes --]

On Friday 03 June 2016 09:29 AM, Krzysztof Opasiak wrote:
>
>
> On 06/02/2016 03:22 PM, Sudip Mukherjee wrote:
>> We have been dereferencing udc before checking it. Lets use it after it
>> has been checked.
>>
>
> To be honest I have mixed feelings about this patch.
>
> On one hand it prevents us from dereferencing potential NULL ptr what is
> generally good. But on the other hand it seems to be a little bit
> pointless overhead. This function is called only in one place, it's
> internal function of vudc driver and in addition generally it is
> currently impossible that this function will get NULL ptr as parameter
> as it's value is taken from container_of(). Not to mention that if this
> is NULL or garbage we will end up in NULL ptr dereference much earlier
> before calling this function.
>
> So if there is something that you would like to fix with this patch and
> you have a real problem with this function could you please provide us
> some more details (for example stack trace)? If this patch is just to
> prevent us from something that will never happen then I would rather to
> not submit this. In my opinion if we get a NULL in this function this
> means that we have some serious problem in UDC core and this check will
> just mask this error.

Yes, I should have seen earlier that the only caller has already 
dereferenced udc. So maybe the following will be appropriate in this 
situation.

Regards
Sudip


[-- Attachment #2: patch1 --]
[-- Type: text/plain, Size: 454 bytes --]

diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
index 99397fa..0f98f2c 100644
--- a/drivers/usb/usbip/vudc_sysfs.c
+++ b/drivers/usb/usbip/vudc_sysfs.c
@@ -40,7 +40,7 @@ int get_gadget_descs(struct vudc *udc)
 	struct usb_ctrlrequest req;
 	int ret;
 
-	if (!udc || !udc->driver || !udc->pullup)
+	if (!udc->driver || !udc->pullup)
 		return -EINVAL;
 
 	req.bRequestType = USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_DEVICE;

Re: [PATCH] usb: usbip: fix null pointer dereference

[Krzysztof Opasiak]

On 06/05/2016 07:54 PM, Sudip Mukherjee wrote:
> On Friday 03 June 2016 09:29 AM, Krzysztof Opasiak wrote:
>>
>>
>> On 06/02/2016 03:22 PM, Sudip Mukherjee wrote:
>>> We have been dereferencing udc before checking it. Lets use it after it
>>> has been checked.
>>>
>>
>> To be honest I have mixed feelings about this patch.
>>
>> On one hand it prevents us from dereferencing potential NULL ptr what is
>> generally good. But on the other hand it seems to be a little bit
>> pointless overhead. This function is called only in one place, it's
>> internal function of vudc driver and in addition generally it is
>> currently impossible that this function will get NULL ptr as parameter
>> as it's value is taken from container_of(). Not to mention that if this
>> is NULL or garbage we will end up in NULL ptr dereference much earlier
>> before calling this function.
>>
>> So if there is something that you would like to fix with this patch and
>> you have a real problem with this function could you please provide us
>> some more details (for example stack trace)? If this patch is just to
>> prevent us from something that will never happen then I would rather to
>> not submit this. In my opinion if we get a NULL in this function this
>> means that we have some serious problem in UDC core and this check will
>> just mask this error.
> 
> Yes, I should have seen earlier that the only caller has already
> dereferenced udc. So maybe the following will be appropriate in this
> situation.
>

Your patch does exactly what Alan suggested and I agree with it;)

Could you please resend this properly so Greg can easily pick it up?

Best regards,
-- 
Krzysztof Opasiak
Samsung R&D Institute Poland
Samsung Electronics

Re: [PATCH] usb: usbip: fix null pointer dereference

[Sudip Mukherjee]

On Mon, Jun 06, 2016 at 10:20:37AM +0200, Krzysztof Opasiak wrote:
> 
> 
> On 06/05/2016 07:54 PM, Sudip Mukherjee wrote:
<snip>
> > 
> > Yes, I should have seen earlier that the only caller has already
> > dereferenced udc. So maybe the following will be appropriate in this
> > situation.
> >
> 
> Your patch does exactly what Alan suggested and I agree with it;)

yes, i saw those mails after i sent the reply with this proposed patch.

> 
> Could you please resend this properly so Greg can easily pick it up?

will send it tonight.

regards
sudip