lkml.org 
[lkml]   [2022]   [Sep]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] usb: gadget: rndis: Avoid dereference before NULL check
Date
NULL check is performed after params->dev is dereferenced in
dev_get_stats.
Fixed by adding a NULL check before dereferencing params->dev and
removing subsequent NULL checks for it.

Signed-off-by: Aniruddha TVS Rao <anrao@nvidia.com>
Signed-off-by: Jim Lin <jilin@nvidia.com>
---
drivers/usb/gadget/function/rndis.c | 37 ++++++++++++-----------------
1 file changed, 15 insertions(+), 22 deletions(-)

diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c
index 64de9f1b874c..d2f18f34c8e5 100644
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -198,6 +198,9 @@ static int gen_ndis_query_resp(struct rndis_params *params, u32 OID, u8 *buf,
outbuf = (__le32 *)&resp[1];
resp->InformationBufferOffset = cpu_to_le32(16);

+ if (!params->dev)
+ return -ENODEV;
+
net = params->dev;
stats = dev_get_stats(net, &temp);

@@ -246,10 +249,8 @@ static int gen_ndis_query_resp(struct rndis_params *params, u32 OID, u8 *buf,
/* mandatory */
case RNDIS_OID_GEN_MAXIMUM_FRAME_SIZE:
pr_debug("%s: RNDIS_OID_GEN_MAXIMUM_FRAME_SIZE\n", __func__);
- if (params->dev) {
- *outbuf = cpu_to_le32(params->dev->mtu);
- retval = 0;
- }
+ *outbuf = cpu_to_le32(params->dev->mtu);
+ retval = 0;
break;

/* mandatory */
@@ -266,19 +267,15 @@ static int gen_ndis_query_resp(struct rndis_params *params, u32 OID, u8 *buf,
/* mandatory */
case RNDIS_OID_GEN_TRANSMIT_BLOCK_SIZE:
pr_debug("%s: RNDIS_OID_GEN_TRANSMIT_BLOCK_SIZE\n", __func__);
- if (params->dev) {
- *outbuf = cpu_to_le32(params->dev->mtu);
- retval = 0;
- }
+ *outbuf = cpu_to_le32(params->dev->mtu);
+ retval = 0;
break;

/* mandatory */
case RNDIS_OID_GEN_RECEIVE_BLOCK_SIZE:
pr_debug("%s: RNDIS_OID_GEN_RECEIVE_BLOCK_SIZE\n", __func__);
- if (params->dev) {
- *outbuf = cpu_to_le32(params->dev->mtu);
- retval = 0;
- }
+ *outbuf = cpu_to_le32(params->dev->mtu);
+ retval = 0;
break;

/* mandatory */
@@ -405,21 +402,17 @@ static int gen_ndis_query_resp(struct rndis_params *params, u32 OID, u8 *buf,
/* mandatory */
case RNDIS_OID_802_3_PERMANENT_ADDRESS:
pr_debug("%s: RNDIS_OID_802_3_PERMANENT_ADDRESS\n", __func__);
- if (params->dev) {
- length = ETH_ALEN;
- memcpy(outbuf, params->host_mac, length);
- retval = 0;
- }
+ length = ETH_ALEN;
+ memcpy(outbuf, params->host_mac, length);
+ retval = 0;
break;

/* mandatory */
case RNDIS_OID_802_3_CURRENT_ADDRESS:
pr_debug("%s: RNDIS_OID_802_3_CURRENT_ADDRESS\n", __func__);
- if (params->dev) {
- length = ETH_ALEN;
- memcpy(outbuf, params->host_mac, length);
- retval = 0;
- }
+ length = ETH_ALEN;
+ memcpy(outbuf, params->host_mac, length);
+ retval = 0;
break;

/* mandatory */
--
2.17.1
\
 
 \ /
  Last update: 2022-09-08 19:58    [W:0.086 / U:0.844 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site