linux-kernel - Re: [PATCH 1/1] usb: hub: check return value

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 24 Apr 2017 09:25:23 +0530
From:   Viresh Kumar <viresh.kumar@...aro.org>
To:     Pan Bian <bianpan201602@....com>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Alan Stern <stern@...land.harvard.edu>,
        Mathias Nyman <mathias.nyman@...ux.intel.com>,
        Guenter Roeck <linux@...ck-us.net>,
        Wolfram Sang <wsa-dev@...g-engineering.com>,
        Geert Uytterhoeven <geert@...ux-m68k.org>,
        linux-usb@...r.kernel.org,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Pan Bian <bianpan2016@....com>
Subject: Re: [PATCH 1/1] usb: hub: check return value

On Sun, Apr 23, 2017 at 4:52 PM, Pan Bian <bianpan201602@....com> wrote:
> From: Pan Bian <bianpan2016@....com>
>
> Function usb_autopm_get_interface() will return a negative errno on
> failure, and function usb_autopm_put_interface() should not be called if
> it fails. However, in function usb_remove_device(), the return value of
> function usb_autopm_get_interface() is not validated before calling
> usb_autopm_put_interface().
>
> Signed-off-by: Pan Bian <bianpan2016@....com>
> ---
>  drivers/usb/core/hub.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
> index 5286bf6..9627175 100644
> --- a/drivers/usb/core/hub.c
> +++ b/drivers/usb/core/hub.c
> @@ -940,16 +940,18 @@ int usb_remove_device(struct usb_device *udev)
>  {
>         struct usb_hub *hub;
>         struct usb_interface *intf;
> +       int if_err;
>
>         if (!udev->parent)      /* Can't remove a root hub */
>                 return -EINVAL;
>         hub = usb_hub_to_struct_hub(udev->parent);
>         intf = to_usb_interface(hub->intfdev);
>
> -       usb_autopm_get_interface(intf);
> +       if_err = usb_autopm_get_interface(intf);

Why shouldn't we return right from here ?

>         set_bit(udev->portnum, hub->removed_bits);
>         hub_port_logical_disconnect(hub, udev->portnum);
> -       usb_autopm_put_interface(intf);
> +       if (!if_err)
> +               usb_autopm_put_interface(intf);
>         return 0;
>  }
>
> --
> 1.9.1
>
>