linux-kernel - Re: [PATCH v9] usb: gadget: u_serial: Add null pointer check in gs_read_complete & gs_write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <329f65dd-a23b-460f-85ee-84fe674fe97d@kernel.org>
Date: Mon, 2 Sep 2024 18:16:06 +0200
From: Krzysztof Kozlowski <krzk@...nel.org>
To: 胡连勤 <hulianqin@...o.com>,
 Michael Nazzareno Trimarchi <michael@...rulasolutions.com>,
 Prashanth K <quic_prashk@...cinc.com>,
 "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
Cc: "quic_jjohnson@...cinc.com" <quic_jjohnson@...cinc.com>,
 "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
 "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
 "opensource.kernel" <opensource.kernel@...o.com>,
 "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>
Subject: Re: [PATCH v9] usb: gadget: u_serial: Add null pointer check in
 gs_read_complete & gs_write_complete

On 29/08/2024 13:54, 胡连勤 wrote:
> From: Lianqin Hu <hulianqin@...o.com>
> 
> Considering that in some extreme cases, when the unbind operation
> is being executed, gserial_disconnect has already cleared gser->ioport,
> triggering a gadget reconfiguration at this time and gs_read_complete
> gets called afterwards, which results in accessing null pointer,
> add a null pointer check to prevent this situation.
> 

...

>  
>  static void gs_write_complete(struct usb_ep *ep, struct usb_request *req)
>  {
> -	struct gs_port	*port = ep->driver_data;
> +	struct gs_port	*port;
> +	unsigned long  flags;
> +
> +	spin_lock_irqsave(&serial_port_lock, flags);
> +	port = ep->driver_data;
> +
> +	if (!port) {
> +		spin_unlock_irqrestore(&serial_port_lock, flags);
> +		return;
> +	}
>  
>  	spin_lock(&port->port_lock);
> +	spin_unlock(&serial_port_lock);

You pinged us for this after 4 days. This is damn v9 and still
unresolved comments from previous review.

Explain, how did you resolve Greg's comment about this unintuitive code:
https://lore.kernel.org/all/2024082251-grief-profanity-b0da@gregkh/

Pattern of immediacy, rush and impatience was used in one of latest big
messes (just google about harassing open source maintainers by some
random contributors).

I suggest go back to drawing board and improve the code instead of
making it spaghetti without explanation, even though we asked for that
explanation.


Best regards,
Krzysztof