Skip to content

Commit

Permalink
usb: xhci: Fix a potential null pointer dereference in xhci_debugfs_c…
Browse files Browse the repository at this point in the history
…reate_endpoint()

In xhci_debugfs_create_slot(), kzalloc() can fail and
dev->debugfs_private will be NULL.
In xhci_debugfs_create_endpoint(), dev->debugfs_private is used without
any null-pointer check, and can cause a null pointer dereference.

To fix this bug, a null-pointer check is added in
xhci_debugfs_create_endpoint().

This bug is found by a runtime fuzzing tool named FIZZER written by us.

[subjet line change change, add potential -Mathais]
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Jia-Ju Bai authored and Greg Kroah-Hartman committed May 22, 2019
1 parent 597c56e commit 5bce256
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions drivers/usb/host/xhci-debugfs.c
Original file line number Diff line number Diff line change
Expand Up @@ -440,6 +440,9 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci,
struct xhci_ep_priv *epriv;
struct xhci_slot_priv *spriv = dev->debugfs_private;

if (!spriv)
return;

if (spriv->eps[ep_index])
return;

Expand Down

0 comments on commit 5bce256

Please sign in to comment.