linux-kernel - RE: [PATCH] usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 1 Dec 2021 07:28:06 +0000
From:   Pawel Laszczak <pawell@...ence.com>
To:     Zhou Qingyang <zhou1615@....edu>
CC:     "kjlu@....edu" <kjlu@....edu>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Peter Chen <peter.chen@....com>,
        "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] usb: cdnsp: Fix a NULL pointer dereference in
 cdnsp_endpoint_init()

>
>In cdnsp_endpoint_init(), cdnsp_ring_alloc() is assigned to pep->ring
>and there is a dereference of it in cdnsp_endpoint_init(), which could
>lead to a NULL pointer dereference on failure of cdnsp_ring_alloc().
>
>Fix this bug by adding a check of pep->ring.
>
>This bug was found by a static analyzer. The analysis employs
>differential checking to identify inconsistent security operations
>(e.g., checks or kfrees) between two code paths and confirms that the
>inconsistent operations are not recovered in the current function or
>the callers, so they constitute bugs.
>
>Note that, as a bug found by static analysis, it can be a false
>positive or hard to trigger. Multiple researchers have cross-reviewed
>the bug.
>
>Builds with CONFIG_USB_CDNSP_GADGET=y show no new warnings,
>and our static analyzer no longer warns about this code.
>
>Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
>Signed-off-by: Zhou Qingyang <zhou1615@....edu>
>---
> drivers/usb/cdns3/cdnsp-mem.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/drivers/usb/cdns3/cdnsp-mem.c b/drivers/usb/cdns3/cdnsp-mem.c
>index ad9aee3f1e39..97866bfb2da9 100644
>--- a/drivers/usb/cdns3/cdnsp-mem.c
>+++ b/drivers/usb/cdns3/cdnsp-mem.c
>@@ -987,6 +987,9 @@ int cdnsp_endpoint_init(struct cdnsp_device *pdev,
>
> 	/* Set up the endpoint ring. */
> 	pep->ring = cdnsp_ring_alloc(pdev, 2, ring_type, max_packet, mem_flags);
>+	if (!pep->ring)
>+		return -ENOMEM;
>+
> 	pep->skip = false;
>
> 	/* Fill the endpoint context */
>--
>2.25.1


Acked-by: Pawel Laszczak <pawell@...ence.com>

--

Thanks,
Pawel Laszczak