usb: xhci: Fix a potential null pointer dereference in xhci_debugfs_create_endpoint() [Linux 5.2]

usb: xhci: Fix a potential null pointer dereference in xhci_debugfs_create_endpoint() [Linux 5.2]

This Linux kernel change "usb: xhci: Fix a potential null pointer dereference in xhci_debugfs_create_endpoint()" is included in the Linux 5.2 release. This change is authored by Jia-Ju Bai <baijiaju1990 [at] gmail.com> on Wed May 22 14:33:58 2019 +0300. The commit for this change in Linux stable tree is 5bce256 (patch).

usb: xhci: Fix a potential null pointer dereference in xhci_debugfs_create_endpoint()

In xhci_debugfs_create_slot(), kzalloc() can fail and
dev->debugfs_private will be NULL.
In xhci_debugfs_create_endpoint(), dev->debugfs_private is used without
any null-pointer check, and can cause a null pointer dereference.

To fix this bug, a null-pointer check is added in
xhci_debugfs_create_endpoint().

This bug is found by a runtime fuzzing tool named FIZZER written by us.

[subjet line change change, add potential -Mathais]
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

There are 3 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 drivers/usb/host/xhci-debugfs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
index cadc013..7ba6afc 100644
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -440,6 +440,9 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci,
    struct xhci_ep_priv *epriv;
    struct xhci_slot_priv   *spriv = dev->debugfs_private;

+   if (!spriv)
+       return;
+
    if (spriv->eps[ep_index])
        return;

Leave a Reply

Your email address will not be published. Required fields are marked *