Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1412465 > unrolled thread

[PATCH] usb: usbip: fix null pointer dereference

Back to article view | Back to linux.kernel

Contents

  [PATCH] usb: usbip: fix null pointer dereference Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2016-06-02 20:00 +0200
    Re: [PATCH] usb: usbip: fix null pointer dereference Krzysztof Opasiak <k.opasiak@samsung.com> - 2016-06-03 10:30 +0200
      Re: [PATCH] usb: usbip: fix null pointer dereference Alan Stern <stern@rowland.harvard.edu> - 2016-06-03 16:30 +0200
      Re: [PATCH] usb: usbip: fix null pointer dereference Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2016-06-05 20:00 +0200
        Re: [PATCH] usb: usbip: fix null pointer dereference Krzysztof Opasiak <k.opasiak@samsung.com> - 2016-06-06 10:30 +0200
          Re: [PATCH] usb: usbip: fix null pointer dereference Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2016-06-06 10:50 +0200

#1412465 — [PATCH] usb: usbip: fix null pointer dereference

We have been dereferencing udc before checking it. Lets use it after it
has been checked.

Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
---
 drivers/usb/usbip/vudc_sysfs.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
index 99397fa..0ba6a06 100644
--- a/drivers/usb/usbip/vudc_sysfs.c
+++ b/drivers/usb/usbip/vudc_sysfs.c
@@ -35,14 +35,17 @@
 int get_gadget_descs(struct vudc *udc)
 {
 	struct vrequest *usb_req;
-	struct vep *ep0 = to_vep(udc->gadget.ep0);
-	struct usb_device_descriptor *ddesc = &udc->dev_desc;
+	struct vep *ep0;
+	struct usb_device_descriptor *ddesc;
 	struct usb_ctrlrequest req;
 	int ret;
 
 	if (!udc || !udc->driver || !udc->pullup)
 		return -EINVAL;
 
+	ep0 = to_vep(udc->gadget.ep0);
+	ddesc = &udc->dev_desc;
+
 	req.bRequestType = USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_DEVICE;
 	req.bRequest = USB_REQ_GET_DESCRIPTOR;
 	req.wValue = cpu_to_le16(USB_DT_DEVICE << 8);
-- 
1.9.1

[toc] | [next] | [standalone]

#1412908

On 06/02/2016 03:22 PM, Sudip Mukherjee wrote:
> We have been dereferencing udc before checking it. Lets use it after it
> has been checked.
> 

To be honest I have mixed feelings about this patch.

On one hand it prevents us from dereferencing potential NULL ptr what is
generally good. But on the other hand it seems to be a little bit
pointless overhead. This function is called only in one place, it's
internal function of vudc driver and in addition generally it is
currently impossible that this function will get NULL ptr as parameter
as it's value is taken from container_of(). Not to mention that if this
is NULL or garbage we will end up in NULL ptr dereference much earlier
before calling this function.

So if there is something that you would like to fix with this patch and
you have a real problem with this function could you please provide us
some more details (for example stack trace)? If this patch is just to
prevent us from something that will never happen then I would rather to
not submit this. In my opinion if we get a NULL in this function this
means that we have some serious problem in UDC core and this check will
just mask this error.

Best regards,
-- 
Krzysztof Opasiak
Samsung R&D Institute Poland
Samsung Electronics

[toc] | [prev] | [next] | [standalone]

#1413269

On Fri, 3 Jun 2016, Krzysztof Opasiak wrote:

> On 06/02/2016 03:22 PM, Sudip Mukherjee wrote:
> > We have been dereferencing udc before checking it. Lets use it after it
> > has been checked.
> > 
> 
> To be honest I have mixed feelings about this patch.
> 
> On one hand it prevents us from dereferencing potential NULL ptr what is
> generally good. But on the other hand it seems to be a little bit
> pointless overhead. This function is called only in one place, it's
> internal function of vudc driver and in addition generally it is
> currently impossible that this function will get NULL ptr as parameter
> as it's value is taken from container_of(). Not to mention that if this
> is NULL or garbage we will end up in NULL ptr dereference much earlier
> before calling this function.
> 
> So if there is something that you would like to fix with this patch and
> you have a real problem with this function could you please provide us
> some more details (for example stack trace)? If this patch is just to
> prevent us from something that will never happen then I would rather to
> not submit this. In my opinion if we get a NULL in this function this
> means that we have some serious problem in UDC core and this check will
> just mask this error.

Normally in this situation, somebody would write a patch that removes 
these lines from get_gadget_descs():

	if (!udc || !udc->driver || !udc->pullup)
		return -EINVAL;

Or maybe (I'm not familiar with the driver so I don't know the best 
approach) changes the test to:

	if (!udc->driver || !udc->pullup)

After all, there's no reason to check !udc if it is known beforehand 
that udc will never be NULL.

Alan Stern

[toc] | [prev] | [next] | [standalone]

#1414136

[Multipart message — attachments visible in raw view] — view raw

On Friday 03 June 2016 09:29 AM, Krzysztof Opasiak wrote:
>
>
> On 06/02/2016 03:22 PM, Sudip Mukherjee wrote:
>> We have been dereferencing udc before checking it. Lets use it after it
>> has been checked.
>>
>
> To be honest I have mixed feelings about this patch.
>
> On one hand it prevents us from dereferencing potential NULL ptr what is
> generally good. But on the other hand it seems to be a little bit
> pointless overhead. This function is called only in one place, it's
> internal function of vudc driver and in addition generally it is
> currently impossible that this function will get NULL ptr as parameter
> as it's value is taken from container_of(). Not to mention that if this
> is NULL or garbage we will end up in NULL ptr dereference much earlier
> before calling this function.
>
> So if there is something that you would like to fix with this patch and
> you have a real problem with this function could you please provide us
> some more details (for example stack trace)? If this patch is just to
> prevent us from something that will never happen then I would rather to
> not submit this. In my opinion if we get a NULL in this function this
> means that we have some serious problem in UDC core and this check will
> just mask this error.

Yes, I should have seen earlier that the only caller has already 
dereferenced udc. So maybe the following will be appropriate in this 
situation.

Regards
Sudip

[toc] | [prev] | [next] | [standalone]

#1414738

On 06/05/2016 07:54 PM, Sudip Mukherjee wrote:
> On Friday 03 June 2016 09:29 AM, Krzysztof Opasiak wrote:
>>
>>
>> On 06/02/2016 03:22 PM, Sudip Mukherjee wrote:
>>> We have been dereferencing udc before checking it. Lets use it after it
>>> has been checked.
>>>
>>
>> To be honest I have mixed feelings about this patch.
>>
>> On one hand it prevents us from dereferencing potential NULL ptr what is
>> generally good. But on the other hand it seems to be a little bit
>> pointless overhead. This function is called only in one place, it's
>> internal function of vudc driver and in addition generally it is
>> currently impossible that this function will get NULL ptr as parameter
>> as it's value is taken from container_of(). Not to mention that if this
>> is NULL or garbage we will end up in NULL ptr dereference much earlier
>> before calling this function.
>>
>> So if there is something that you would like to fix with this patch and
>> you have a real problem with this function could you please provide us
>> some more details (for example stack trace)? If this patch is just to
>> prevent us from something that will never happen then I would rather to
>> not submit this. In my opinion if we get a NULL in this function this
>> means that we have some serious problem in UDC core and this check will
>> just mask this error.
> 
> Yes, I should have seen earlier that the only caller has already
> dereferenced udc. So maybe the following will be appropriate in this
> situation.
>

Your patch does exactly what Alan suggested and I agree with it;)

Could you please resend this properly so Greg can easily pick it up?

Best regards,
-- 
Krzysztof Opasiak
Samsung R&D Institute Poland
Samsung Electronics

[toc] | [prev] | [next] | [standalone]

#1414774

On Mon, Jun 06, 2016 at 10:20:37AM +0200, Krzysztof Opasiak wrote:
> 
> 
> On 06/05/2016 07:54 PM, Sudip Mukherjee wrote:
<snip>
> > 
> > Yes, I should have seen earlier that the only caller has already
> > dereferenced udc. So maybe the following will be appropriate in this
> > situation.
> >
> 
> Your patch does exactly what Alan suggested and I agree with it;)

yes, i saw those mails after i sent the reply with this proposed patch.

> 
> Could you please resend this properly so Greg can easily pick it up?

will send it tonight.

regards
sudip

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web