lkml.org 
[lkml]   [2011]   [Jul]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] USB: Avoid NULL pointer dereference in usb_disconnect()
On Mon, 11 Jul 2011, Jesper Juhl wrote:

> If, in drivers/usb/core/hub.c::usb_disconnect(), 'udev' is NULL, then
> we'll never get to the printing of a debug message and returning from
> the function since we'll have already dereferenced the NULL pointer in
> the bus_to_hcd(udev->bus) call.
> This patch moves the dereference to after the test for NULL, thus
> avoiding that potential crash.
>
> Signed-off-by: Jesper Juhl <jj@chaosbits.net>
> ---
> drivers/usb/core/hub.c | 4 +++-
> 1 files changed, 3 insertions(+), 1 deletions(-)
>
> disclaimer: compile tested only.
>
> diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
> index a428aa0..0a98c76 100644
> --- a/drivers/usb/core/hub.c
> +++ b/drivers/usb/core/hub.c
> @@ -1634,13 +1634,15 @@ void usb_disconnect(struct usb_device **pdev)
> {
> struct usb_device *udev = *pdev;
> int i;
> - struct usb_hcd *hcd = bus_to_hcd(udev->bus);
> + struct usb_hcd *hcd;
>
> if (!udev) {
> pr_debug ("%s nodev\n", __func__);
> return;
> }
>
> + hcd = bus_to_hcd(udev->bus);
> +
> /* mark the device as inactive, so any further urb submissions for
> * this device (and any of its children) will fail immediately.
> * this quiesces everything except pending urbs.

This is okay, but it might be better just to remove the NULL test
entirely. Code inspection easily shows that it can never be triggered.

Alan Stern



\
 
 \ /
  Last update: 2011-07-11 17:03    [W:0.151 / U:0.720 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site