lkml.org 
[lkml]   [2014]   [Aug]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.13 021/259] usb: gadget: f_fs: fix NULL pointer dereference when there are no strings
    Date
    3.13.11.6 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Michal Nazarewicz <mina86@mina86.com>

    commit f0688c8b81d2ea239c3fb0b848f623b579238d99 upstream.

    If the descriptors do not need any strings and user space sends empty
    set of strings, the ffs->stringtabs field remains NULL. Thus
    *ffs->stringtabs in functionfs_bind leads to a NULL pointer
    dereferenece.

    The bug was introduced by commit [fd7c9a007f: “use usb_string_ids_n()”].

    While at it, remove double initialisation of lang local variable in
    that function.

    ffs->strings_count does not need to be checked in any way since in
    the above scenario it will remain zero and usb_string_ids_n() is
    a no-operation when colled with 0 argument.

    Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    drivers/usb/gadget/f_fs.c | 12 +++++++-----
    1 file changed, 7 insertions(+), 5 deletions(-)

    diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
    index 241fc87..dfa83df 100644
    --- a/drivers/usb/gadget/f_fs.c
    +++ b/drivers/usb/gadget/f_fs.c
    @@ -1389,11 +1389,13 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
    ffs->ep0req->context = ffs;

    lang = ffs->stringtabs;
    - for (lang = ffs->stringtabs; *lang; ++lang) {
    - struct usb_string *str = (*lang)->strings;
    - int id = first_id;
    - for (; str->s; ++id, ++str)
    - str->id = id;
    + if (lang) {
    + for (; *lang; ++lang) {
    + struct usb_string *str = (*lang)->strings;
    + int id = first_id;
    + for (; str->s; ++id, ++str)
    + str->id = id;
    + }
    }

    ffs->gadget = cdev->gadget;
    --
    1.9.1
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2014-08-08 23:01    [W:6.441 / U:0.392 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site