linux-kernel - Re: [PATCH] USB: core: of: Check device_node before parsing in usb_of_get_child

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44L0.1608151529450.1827-100000@iolanthe.rowland.org>
Date:	Mon, 15 Aug 2016 15:34:08 -0400 (EDT)
From:	Alan Stern <stern@...land.harvard.edu>
To:	Greg KH <gregkh@...uxfoundation.org>
cc:	Vaibhav Hiremath <vaibhav.hiremath@...aro.org>,
	<linux-usb@...r.kernel.org>, <robh@...nel.org>,
	<p.zabel@...gutronix.de>, <arnd@...db.de>,
	<peter.chen@...escale.com>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] USB: core: of: Check device_node before parsing in
 usb_of_get_child_node()

On Mon, 15 Aug 2016, Greg KH wrote:

> On Mon, Aug 15, 2016 at 11:31:10AM -0700, Vaibhav Hiremath wrote:
> > In case of HUB devices connected to USB ports, we may not have DT
> > node representing it inside USB, and when devices connected to hub
> > gets enumerated, call to usb_of_get_child_node() leads to NULL pointer
> > dereference.
> 
> Really?  That seems messed up.
> 
> > In the usecase we have, where EHCI port is connected to USB HUB
> > device, and downward ports of HUB are connected to further USB
> > devices. When those devices gets enumerated, in order,
> >  1. USB HUB ->
> > 	-> Call to usb_of_get_child_node() is OK, as
> > 	parent->dev.of_node is pointing to host node.
> >  2. Devices connected to downward port of USB HUB
> >  	-> Call to usb_of_get_child_node() leads to NULL
> > 	pointer dereference as parent->dev.of_node = NULL,
> > 	as USB HUB DTS node may be empty.
> 
> Why is the hub DTS empty?  Shouldn't that be the fix here?

It's empty because there's no DT entry for the hub.  That's normal; 
most USB devices aren't represented in DT because they aren't part of 
the original system -- they are added plugged in later.

Or, it's possible that the hub _is_ part of the original system and it 
was left out of the DT database.

Alan Stern