USB: usbip: fix null-ptr-deref in status_show_vhci()
Subsystems (2)
PATCH 1/1 USB: usbip: fix null-ptr-deref in status_show_vhci()
If usb_add_hcd() fails in vhci_hcd_probe() (i.e., a probe failure), the error path calls usb_remove_hcd() and also sets pdev->dev.driver_data to NULL.
Consequently, any subsequent call to platform_get_drvdata(pdev) (which returns pdev->dev.driver_data) may yield NULL, causing a crash if that pointer is dereferenced.
Fix this by adding a sanity check to ensure "hcd" is non-NULL before proceeding with further operations.
--- drivers/usb/usbip/vhci_sysfs.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/usbip/vhci_sysfs.c +4 -0
@@ -76,6 +76,10 @@ static ssize_t status_show_vhci(int pdev_nr, char *out) } hcd =platform_get_drvdata (pdev); + +if (!hcd) +return 0 ; + vhci_hcd =hcd_to_vhci_hcd (hcd); vhci = vhci_hcd->vhci;
Signature · 1 line
2.39.5
Quoted 25 lines · Qasim Ijaz
If
usb_add_hcd()fails invhci_hcd_probe()(i.e., a probe failure), the error path callsusb_remove_hcd()and also setspdev->dev.driver_datato NULL.Consequently, any subsequent call to
platform_get_drvdata(pdev)(which returnspdev->dev.driver_data) may yield NULL, causing a crash if that pointer is dereferenced.Fix this by adding a sanity check to ensure "hcd" is non-NULL before proceeding with further operations.
Reported-by syzbot <[email protected]>Tested-by syzbot <[email protected]>Fixes 03cd00d538a6 ("usbip: vhci-hcd: Set the vhci structure up to work")Signed-off-by Qasim Ijaz <[email protected]>--- drivers/usb/usbip/vhci_sysfs.c | 4 ++++ 1 file changed, 4 insertions(+)drivers/usb/usbip/vhci_sysfs.c +0
-0
drivers/usb/usbip/vhci_sysfs.c static ssize_t status_show_vhci(int pdev_nr, char *out) · line 79
Quoted 4 lines
drivers/usb/usbip/vhci_sysfs.c +1
-0@@ -76,6 +76,10 @@ static ssize_t status_show_vhci(int pdev_nr, char *out) } hcd =platform_get_drvdata (pdev); +
Empty line net really needed here...
drivers/usb/usbip/vhci_sysfs.c static ssize_t status_show_vhci(int pdev_nr, char *out) · line 85
Quoted 6 lines
drivers/usb/usbip/vhci_sysfs.c +3
-0+if (!hcd) +return 0 ; + vhci_hcd =hcd_to_vhci_hcd (hcd); vhci = vhci_hcd->vhci;
MBR, Sergey