lkml.org 
[lkml]   [2022]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.18 0794/1095] usb: cdns3: change place of priv_ep assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable()
    Date
    From: Andrey Strachuk <strochuk@ispras.ru>

    [ Upstream commit c3ffc9c4ca44bfe9562166793d133e1fb0630ea6 ]

    If 'ep' is NULL, result of ep_to_cdns3_ep(ep) is invalid pointer
    and its dereference with priv_ep->cdns3_dev may cause panic.

    Found by Linux Verification Center (linuxtesting.org) with SVACE.

    Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
    Acked-by: Peter Chen <peter.chen@kernel.org>
    Signed-off-by: Andrey Strachuk <strochuk@ispras.ru>
    Link: https://lore.kernel.org/r/20220718160052.4188-1-strochuk@ispras.ru
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/usb/cdns3/cdns3-gadget.c | 9 ++++++---
    1 file changed, 6 insertions(+), 3 deletions(-)

    diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
    index d6d515d598dc..e0cf62e65075 100644
    --- a/drivers/usb/cdns3/cdns3-gadget.c
    +++ b/drivers/usb/cdns3/cdns3-gadget.c
    @@ -2281,14 +2281,15 @@ static int cdns3_gadget_ep_enable(struct usb_ep *ep,
    int val;

    priv_ep = ep_to_cdns3_ep(ep);
    - priv_dev = priv_ep->cdns3_dev;
    - comp_desc = priv_ep->endpoint.comp_desc;

    if (!ep || !desc || desc->bDescriptorType != USB_DT_ENDPOINT) {
    dev_dbg(priv_dev->dev, "usbss: invalid parameters\n");
    return -EINVAL;
    }

    + comp_desc = priv_ep->endpoint.comp_desc;
    + priv_dev = priv_ep->cdns3_dev;
    +
    if (!desc->wMaxPacketSize) {
    dev_err(priv_dev->dev, "usbss: missing wMaxPacketSize\n");
    return -EINVAL;
    @@ -2596,7 +2597,7 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep,
    struct usb_request *request)
    {
    struct cdns3_endpoint *priv_ep = ep_to_cdns3_ep(ep);
    - struct cdns3_device *priv_dev = priv_ep->cdns3_dev;
    + struct cdns3_device *priv_dev;
    struct usb_request *req, *req_temp;
    struct cdns3_request *priv_req;
    struct cdns3_trb *link_trb;
    @@ -2607,6 +2608,8 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep,
    if (!ep || !request || !ep->desc)
    return -EINVAL;

    + priv_dev = priv_ep->cdns3_dev;
    +
    spin_lock_irqsave(&priv_dev->lock, flags);

    priv_req = to_cdns3_request(request);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-16 00:25    [W:3.035 / U:0.320 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site