linux-kernel - Re: [PATCH] device_core: check null pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CADYyEwQQOfvAtEfqMNrcLROHcMZmPQWJxuKSugHDeK_SHk-EQw@mail.gmail.com>
Date: Mon, 17 Nov 2025 10:55:05 +0800
From: Zhengqiao Xia <xiazhengqiao@...qin.corp-partner.google.com>
To: Greg KH <gregkh@...uxfoundation.org>
Cc: rafael@...nel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] device_core: check null pointer

Hi Greg,

Based on my analysis,

usb_new_device ->  device_add -> device_private_init
                                                    ->
bus_probe_device -> usb_generic_driver_probe  ->
usb_set_configuration  -> "add each interface"  ->
device_add(&intf->dev);


                                    --> if of_node status is disabled
-> of_device_is_available is false -> not running  device_add ->
interface dev->p is null
usbdev_ioctl -> proc_ioctl -> device_attach -> __device_attach ->
device_attach ->  if (dev->p->dead)

Since dev->p has not been created at this time, dev->p is NULL,  So I
think we should add a check here.

Here is my current analysis, but there may be some misunderstandings
or mistakes in it. Could you please help clarify my confusion?

thanks

Greg KH <gregkh@...uxfoundation.org> 于2025年11月16日周日 04:16写道：


>
> On Fri, Nov 14, 2025 at 10:18:21PM +0800, Zhengqiao Xia wrote:
> > Add null pointer check to avoid null pointer.
> > When the USB device's interface is disabled, 'device_add' will not
> > be called, and 'dev->p' will be NULL.
>
> Wait, how does that happen?  Shouldn't we prevent that?
>
> > When you use 'usbdev_ioctl' to
> > call this USB interface at this point,'__device_attach' will be invoked.
> > Then a null pointer will be generated.
> >
> > Signed-off-by: Zhengqiao Xia <xiazhengqiao@...qin.corp-partner.google.com>
>
> Not a valid email address :(
>
> > ---
> >  drivers/base/dd.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/base/dd.c b/drivers/base/dd.c
> > index 3328101e0e106..cfdeb420fd12a 100644
> > --- a/drivers/base/dd.c
> > +++ b/drivers/base/dd.c
> > @@ -1033,7 +1033,7 @@ static int __device_attach(struct device *dev, bool allow_async)
> >       bool async = false;
> >
> >       device_lock(dev);
> > -     if (dev->p->dead) {
> > +     if (dev->p && dev->p->dead) {
>
> If dev->p is NULL here, something else went wrong with the caller,
> please, let's fix the root problem here instead.
>
> What suddenly changed to cause this to happen?
>
> thanks,
>
> greg k-h