linux-kernel - Re: Re: [PATCH] usb: cdns3: Fix potential dereference of NULL pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <465461c9.2a3c6.180dd50e22b.Coremail.lyz_cs@pku.edu.cn>
Date:   Fri, 20 May 2022 01:15:07 +0800 (GMT+08:00)
From:   刘永志 <lyz_cs@....edu.cn>
To:     "greg kh" <gregkh@...uxfoundation.org>
Cc:     peter.chen@...nel.org, pawell@...ence.com, rogerq@...nel.org,
        a-govindraju@...com, felipe.balbi@...ux.intel.com,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        fuyq@....pku.edu.cn
Subject: Re: Re: [PATCH] usb: cdns3:  Fix potential dereference of NULL
 pointer




> -----Original Messages-----
> From: "Greg KH" <gregkh@...uxfoundation.org>
> Sent Time: 2022-05-20 00:07:17 (Friday)
> To: "Yongzhi Liu" <lyz_cs@....edu.cn>
> Cc: peter.chen@...nel.org, pawell@...ence.com, rogerq@...nel.org, a-govindraju@...com, felipe.balbi@...ux.intel.com, linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org, fuyq@....pku.edu.cn
> Subject: Re: [PATCH] usb: cdns3:  Fix potential dereference of NULL pointer
> 
> On Wed, May 18, 2022 at 01:12:50AM -0700, Yongzhi Liu wrote:
> > The return value of cdns3_gadget_ep_alloc_request()
> > needs to be checked to avoid use of NULL pointer
> > in case of an allocation failure.
> > 
> > Fixes: 7733f6c32e36f ("usb: cdns3: Add Cadence USB3 DRD Driver")
> > 
> > Signed-off-by: Yongzhi Liu <lyz_cs@....edu.cn>
> 
> Again, no blank line and use the full width for your text.
> 
> > ---
> >  drivers/usb/cdns3/cdns3-gadget.c | 6 +++++-
> >  1 file changed, 5 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
> > index 5d8c982..7be328e 100644
> > --- a/drivers/usb/cdns3/cdns3-gadget.c
> > +++ b/drivers/usb/cdns3/cdns3-gadget.c
> > @@ -2568,6 +2568,10 @@ static int cdns3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
> >  		struct cdns3_request *priv_req;
> >  
> >  		zlp_request = cdns3_gadget_ep_alloc_request(ep, GFP_ATOMIC);
> > +		if (!zlp_request) {
> > +			ret = -ENOMEM;
> > +			goto err;
> > +		}
> 
> How did you test this that the if the allocation fails this will clean
> up properly?
> 

I find this by a static analyzer based on frequency and similarity, which report many null ptr deref bugs.
In cdns3/cdns3-gadget.c, I find that we usually check the return value when call function 'cdns3_gadget_ep_alloc_request'.
If 'zcalloc' in 'cdns3_gadget_ep_alloc_request' failed, the allocation will return null. Therefore, i think we should add null checks here.
I will resubmit a new patch if you think the bug is real.
Thanks for your reply and advice.

> thanks,
> 
> greg k-h