USB: usbip: fix null-ptr-deref in status_show_vhci()
Subsystems (2)
PATCH v3 1/1 USB: usbip: fix null-ptr-deref in status_show_vhci()
If usb_add_hcd() fails in vhci_hcd_probe() (i.e., a probe failure), the error path calls usb_remove_hcd() and also sets pdev->dev.driver_data to NULL.
Consequently, any subsequent call to platform_get_drvdata(pdev) (which returns pdev->dev.driver_data) may yield NULL, causing a crash if that pointer is dereferenced.
Fix this by adding a sanity check to ensure "hcd" is non-NULL before proceeding with further operations.
---
v3:
- Added this section to comply with patch format requirements
- Removed the extra newline after hcd = platform_get_drvdata(pdev);
drivers/usb/usbip/vhci_sysfs.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/usbip/vhci_sysfs.c +3 -0
@@ -76,6 +76,9 @@ static ssize_t status_show_vhci(int pdev_nr, char *out) } hcd =platform_get_drvdata (pdev); +if (!hcd) +return 0 ; + vhci_hcd =hcd_to_vhci_hcd (hcd); vhci = vhci_hcd->vhci;
Signature · 1 line
2.39.5
Quoted 7 lines · Qasim Ijaz
If
usb_add_hcd()fails invhci_hcd_probe()(i.e., a probe failure), the error path callsusb_remove_hcd()and also setspdev->dev.driver_datato NULL.Consequently, any subsequent call to
platform_get_drvdata(pdev)(which returnspdev->dev.driver_data) may yield NULL, causing a crash if that pointer is dereferenced.
If usb_add_hcd() fails during probe then it should not be possible to have any subsequent calls to platform_get_drvdata(pdev).
Quoted 21 lines
Fix this by adding a sanity check to ensure "hcd" is non-NULL before proceeding with further operations.
Reported-by syzbot <[email protected]>Tested-by syzbot <[email protected]>Fixes 03cd00d538a6 ("usbip: vhci-hcd: Set the vhci structure up to work")Signed-off-by Qasim Ijaz <[email protected]>---
v3:
- Added this section to comply with patch format requirements
- Removed the extra newline afterhcd = platform_get_drvdata(pdev);drivers/usb/usbip/vhci_sysfs.c | 3 +++ 1 file changed, 3 insertions(+)drivers/usb/usbip/vhci_sysfs.c +0
-0
drivers/usb/usbip/vhci_sysfs.c static ssize_t status_show_vhci(int pdev_nr, char *out) · line 80
Quoted 5 lines
drivers/usb/usbip/vhci_sysfs.c +2
-0@@ -76,6 +76,9 @@ static ssize_t status_show_vhci(int pdev_nr, char *out) } hcd =platform_get_drvdata (pdev); +if (!hcd) +return 0 ;
In this case, for example, the status sysfs attribute file should never have been created in the first place if probing failed.
This seems more like a synchronization or logic error, not something to be solved with a simple check for a NULL pointer
Alan Stern
Quoted 8 lines
drivers/usb/usbip/vhci_sysfs.c +1
-0+ vhci_hcd =hcd_to_vhci_hcd (hcd); vhci = vhci_hcd->vhci;Signature · 1 line
2.39.5