diff options
| author | Jia-Ju Bai <baijiaju1990@gmail.com> | 2019-05-22 14:33:58 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-06-22 08:15:16 +0200 |
| commit | f3885eecd2530cb731ea7e13fbb19aa99d10c32b (patch) | |
| tree | aca7d6e4c0d688e023307acbaebc3d9444f38ff9 | |
| parent | 930d31a6f34401ff47e11755e9e3ef55cbfcffe9 (diff) | |
| download | linux-stable-f3885eecd2530cb731ea7e13fbb19aa99d10c32b.tar.gz linux-stable-f3885eecd2530cb731ea7e13fbb19aa99d10c32b.tar.bz2 linux-stable-f3885eecd2530cb731ea7e13fbb19aa99d10c32b.zip | |
usb: xhci: Fix a potential null pointer dereference in xhci_debugfs_create_endpoint()
[ Upstream commit 5bce256f0b528624a34fe907db385133bb7be33e ]
In xhci_debugfs_create_slot(), kzalloc() can fail and
dev->debugfs_private will be NULL.
In xhci_debugfs_create_endpoint(), dev->debugfs_private is used without
any null-pointer check, and can cause a null pointer dereference.
To fix this bug, a null-pointer check is added in
xhci_debugfs_create_endpoint().
This bug is found by a runtime fuzzing tool named FIZZER written by us.
[subjet line change change, add potential -Mathais]
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/usb/host/xhci-debugfs.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c index cadc01336bf8..7ba6afc7ef23 100644 --- a/drivers/usb/host/xhci-debugfs.c +++ b/drivers/usb/host/xhci-debugfs.c @@ -440,6 +440,9 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci, struct xhci_ep_priv *epriv; struct xhci_slot_priv *spriv = dev->debugfs_private; + if (!spriv) + return; + if (spriv->eps[ep_index]) return; |