p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

usbip: fix possibility of dereference by NULLL pointer in vhci_hcd.c 

This patch fixes possibility of dereference by NULLL pointer in "[PATCH
v5 1/3] usbip: vhci extension: modifications to vhci driver" which has
been merged to 4.9-rc1. It occurs when a URB with pointer to invalid
USB/IP device is enqueued in race condition against detach operation.

A pointer was passed to vdev_to_vhci() before NULL check.
In vdev_to_vhci(), there's a dereference by the pointer.

This patch moves vdev_to_vhci() after NULL check of the pointer.

Signed-off-by: Nobuo Iwata <nobuo.iwata@fujixerox.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Nobuo Iwata 2016-10-13 12:49:02 +09:00 committed by Greg Kroah-Hartman
parent 220c61b6f7
commit d79cda045e
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/usb/usbip/vhci_hcd.c
View File

@ -460,13 +460,14 @@ static void vhci_tx_urb(struct urb *urb)
{ {
struct vhci_device *vdev = get_vdev(urb->dev); struct vhci_device *vdev = get_vdev(urb->dev);
struct vhci_priv *priv; struct vhci_priv *priv;
struct vhci_hcd *vhci = vdev_to_vhci(vdev); struct vhci_hcd *vhci;
unsigned long flags; unsigned long flags;
if (!vdev) { if (!vdev) {
pr_err("could not get virtual device"); pr_err("could not get virtual device");
return; return;
} }
vhci = vdev_to_vhci(vdev);
priv = kzalloc(sizeof(struct vhci_priv), GFP_ATOMIC); priv = kzalloc(sizeof(struct vhci_priv), GFP_ATOMIC);
if (!priv) { if (!priv) {