Re: [PATCH] usb: gadget: rndis: Avoid dereference before NULL check

[Jim Lin <jilin@nvidia.com>]

On Fri, 2022-09-09 at 07:38 +0200, Greg KH wrote:
> External email: Use caution opening links or attachments
> 
> 
> On Fri, Sep 09, 2022 at 01:56:15AM +0800, Jim Lin wrote:
> > NULL check is performed after params->dev is dereferenced in
> > dev_get_stats.
> 
> I do not understand this statement.
> 
> > Fixed by adding a NULL check before dereferencing params->dev and
> > removing subsequent NULL checks for it.
> > 
> > Signed-off-by: Aniruddha TVS Rao <anrao@nvidia.com>
> > Signed-off-by: Jim Lin <jilin@nvidia.com>
> > ---
> >  drivers/usb/gadget/function/rndis.c | 37 ++++++++++++-------------
> > ----
> >  1 file changed, 15 insertions(+), 22 deletions(-)
> > 
> > diff --git a/drivers/usb/gadget/function/rndis.c
> > b/drivers/usb/gadget/function/rndis.c
> > index 64de9f1b874c..d2f18f34c8e5 100644
> > --- a/drivers/usb/gadget/function/rndis.c
> > +++ b/drivers/usb/gadget/function/rndis.c
> > @@ -198,6 +198,9 @@ static int gen_ndis_query_resp(struct
> > rndis_params *params, u32 OID, u8 *buf,
> >       outbuf = (__le32 *)&resp[1];
> >       resp->InformationBufferOffset = cpu_to_le32(16);
> > 
> > +     if (!params->dev)
> > +             return -ENODEV;
> > +
> 
> As Sergey points out, this check is useless and the ones below should
> also be removed.
> 
> But, why make this check at all, how did you trigger a problem with
> the
> current code?
> 
> Are you using this driver?  If so, why?  It is totally broken (as per
> the specification) and we really really need to just delete it from
> the
> tree to prevent anyone else from ever using it.
> 
> thanks,
> 
> greg k-h
Thanks for review, please ignore this patch.
Issue was triggered by our internal tool (probably not smart enough,
and cause false alarm).

--nvpublic