linux-kernel - [PATCH 4/4] usb: gadget: fotg210-udc: Fix a potential invalid pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 12 Jan 2018 22:44:33 +0100
From:   Christophe JAILLET <christophe.jaillet@...adoo.fr>
To:     balbi@...nel.org, gregkh@...uxfoundation.org, bhumirks@...il.com,
        leoyang.li@....com
Cc:     linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        kernel-janitors@...r.kernel.org,
        Christophe JAILLET <christophe.jaillet@...adoo.fr>
Subject: [PATCH 4/4] usb: gadget: fotg210-udc: Fix a potential invalid pointer dereference

We should not call 'fotg210_ep_free_request()' with NULL as a 2nd parameter.
Depending of the layout of 'struct fotg210_request', this could lead to an
un-expected behavior.

So, if 'fotg210_ep_alloc_request()' fails, we should return directly.
This also gives the opportunity to further simplify code.


(In fact, this change should be a no-op, because 'req' is the first field of
'struct fotg210_request'. So passing NULL would result in 'free(NULL)' in
'fotg210_ep_free_request()'. Anyway avoiding the goto is cleaner.)

Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
---
 drivers/usb/gadget/udc/fotg210-udc.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index 99a18b14c8c2..03adfcb58548 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -1075,8 +1075,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
 {
 	struct resource *res, *ires;
 	struct fotg210_udc *fotg210 = NULL;
-	int ret = 0;
-	int i;
+	int ret, i;
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (!res) {
@@ -1090,8 +1089,6 @@ static int fotg210_udc_probe(struct platform_device *pdev)
 		return -ENODEV;
 	}
 
-	ret = -ENOMEM;
-
 	/* initialize udc */
 	fotg210 = devm_kzalloc(&pdev->dev, sizeof(struct fotg210_udc),
 			       GFP_KERNEL);
@@ -1155,8 +1152,8 @@ static int fotg210_udc_probe(struct platform_device *pdev)
 
 	fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep,
 				GFP_KERNEL);
-	if (fotg210->ep0_req == NULL)
-		goto err_req;
+	if (!fotg210->ep0_req)
+		return -ENOMEM;
 
 	fotg210_init(fotg210);
 
-- 
2.14.1