linux-kernel - [PATCH 1/7] staging: vt6656: fix potential NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190520163844.1225-2-quentin.deslandes@itdev.co.uk>
Date:   Mon, 20 May 2019 16:39:01 +0000
From:   Quentin Deslandes <quentin.deslandes@...ev.co.uk>
To:     "devel@...verdev.osuosl.org" <devel@...verdev.osuosl.org>
CC:     Forest Bond <forest@...ttletooquiet.net>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Quentin Deslandes <quentin.deslandes@...ev.co.uk>,
        Mukesh Ojha <mojha@...eaurora.org>,
        Ojaswin Mujoo <ojaswin25111998@...il.com>,
        Nishad Kamdar <nishadkamdar@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: [PATCH 1/7] staging: vt6656: fix potential NULL pointer dereference

vnt_free_tx_bufs() relies on priv->tx_context elements to be NULL if
they are not initialized (as vnt_free_rx_bufs() does). Add a check to
these elements in order to avoid NULL pointer dereference.

Signed-off-by: Quentin Deslandes <quentin.deslandes@...ev.co.uk>
---
 drivers/staging/vt6656/main_usb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
index ccafcc2c87ac..bfe952fe27bf 100644
--- a/drivers/staging/vt6656/main_usb.c
+++ b/drivers/staging/vt6656/main_usb.c
@@ -363,6 +363,9 @@ static void vnt_free_tx_bufs(struct vnt_private *priv)
 
 	for (ii = 0; ii < priv->num_tx_context; ii++) {
 		tx_context = priv->tx_context[ii];
+		if (!tx_context)
+			continue;
+
 		/* deallocate URBs */
 		if (tx_context->urb) {
 			usb_kill_urb(tx_context->urb);
-- 
2.17.1