usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
Subsystems (4)
PATCH v2 1/1 usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
It is possible that typec_register_partner() returns ERR_PTR on failure. When port->partner is an error, a NULL pointer dereference may occur as shown below.
[91222.095236][ T319] typec port0: failed to register partner (-17) ... [91225.061491][ T319] Unable to handle kernel NULL pointer dereference at virtual address 000000000000039f [91225.274642][ T319] pc : tcpm_pd_data_request+0x310/0x13fc [91225.274646][ T319] lr : tcpm_pd_data_request+0x298/0x13fc [91225.308067][ T319] Call trace: [91225.308070][ T319] tcpm_pd_data_request+0x310/0x13fc [91225.308073][ T319] tcpm_pd_rx_handler+0x100/0x9e8 [91225.355900][ T319] kthread_worker_fn+0x178/0x58c [91225.355902][ T319] kthread+0x150/0x200 [91225.355905][ T319] ret_from_fork+0x10/0x30
Add a check for port->partner to avoid dereferencing a NULL pointer.
Fixes 5e1d4c49fbc8 ("usb: typec: tcpm: Determine common SVDM Version")
Signed-off-by Jimmy Hu <[email protected]>
--- drivers/usb/typec/tcpm/tcpm.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/typec/tcpm/tcpm.c +3 -0
@@ -1625,6 +1625,9 @@ static int tcpm_pd_svdm(struct tcpm_port *port, struct typec_altmode *adev,if (PD_VDO_VID (p[0 ]) !=USB_SID_PD )break ; +if (IS_ERR_OR_NULL (port->partner)) +break ; +if (PD_VDO_SVDM_VER (p[0 ]) < svdm_version) {typec_partner_set_svdm_version (port->partner,PD_VDO_SVDM_VER (p[0 ]));
Signature · 1 line
2.42.0.758.gaed0368e0e-goog
Quoted 17 lines · Jimmy Hu
It is possible that
typec_register_partner()returnsERR_PTRon failure. Whenport->partneris an error, a NULL pointer dereference may occur as shown below.[91222.095236][ T319] typec port0: failed to register partner (-17) ... [91225.061491][ T319] Unable to handle kernel NULL pointer dereference at virtual address 000000000000039f [91225.274642][ T319] pc : tcpm_pd_data_request+0x310/0x13fc [91225.274646][ T319] lr : tcpm_pd_data_request+0x298/0x13fc [91225.308067][ T319] Call trace: [91225.308070][ T319] tcpm_pd_data_request+0x310/0x13fc [91225.308073][ T319] tcpm_pd_rx_handler+0x100/0x9e8 [91225.355900][ T319] kthread_worker_fn+0x178/0x58c [91225.355902][ T319] kthread+0x150/0x200 [91225.355905][ T319] ret_from_fork+0x10/0x30
Quoted 5 lines
Add a check for
port->partnerto avoid dereferencing a NULL pointer.Fixes 5e1d4c49fbc8 ("usb: typec: tcpm: Determine common SVDM Version")Signed-off-by Jimmy Hu <[email protected]>
Acked-by Heikki Krogerus <[email protected]>
Quoted 18 lines
--- drivers/usb/typec/tcpm/tcpm.c | 3 +++ 1 file changed, 3 insertions(+)drivers/usb/typec/tcpm/tcpm.c +3
-0@@ -1625,6 +1625,9 @@ static int tcpm_pd_svdm(struct tcpm_port *port, struct typec_altmode *adev,if (PD_VDO_VID (p[0 ]) !=USB_SID_PD )break ; +if (IS_ERR_OR_NULL (port->partner)) +break ; +if (PD_VDO_SVDM_VER (p[0 ]) < svdm_version) {typec_partner_set_svdm_version (port->partner,PD_VDO_SVDM_VER (p[0 ]));
Signature · 1 line
heikki