From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754873AbbFKQmY (ORCPT ); Thu, 11 Jun 2015 12:42:24 -0400 Received: from devils.ext.ti.com ([198.47.26.153]:49470 "EHLO devils.ext.ti.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752336AbbFKQmV (ORCPT ); Thu, 11 Jun 2015 12:42:21 -0400 From: Kishon Vijay Abraham I To: , , , , CC: , Subject: [RFC PATCH] usb: gadget: composite: Fix NULL pointer dereference Date: Thu, 11 Jun 2015 22:12:11 +0530 Message-ID: <1434040931-19023-1-git-send-email-kishon@ti.com> X-Mailer: git-send-email 1.7.9.5 MIME-Version: 1.0 Content-Type: text/plain Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org commit f563d230903210acc ("usb: gadget: composite: add req_match method to usb_function") accesses cdev->config even before set config is invoked causing a NULL pointer dereferencing error while running Lecroy Mass Storage Compliance test. Fix it here by accessing cdev->config only if it is non NULL. Fixes: commit f563d230903210acc ("usb: gadget: composite: add req_match method to usb_function"). Signed-off-by: Kishon Vijay Abraham I --- Running Mass Storage Examples (TD.1.01 Interface Descriptor Test) in Lecroy Compliance Suite produces this NULL pointer dereference abort. The request is actually "non-core control reqa0.06 v2a00 i0000 l12" Tested this patch using USB3 Gen X CV (ch9 tests: usb2 and usb3, link layer testing and MSC tests) and using USB2 X CV (ch9 tests, MSC tests) and verified this doesn't cause any failures. drivers/usb/gadget/composite.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index 4e3447b..58b4657 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -1758,10 +1758,13 @@ unknown: * take such requests too, if that's ever needed: to work * in config 0, etc. */ - list_for_each_entry(f, &cdev->config->functions, list) - if (f->req_match && f->req_match(f, ctrl)) - goto try_fun_setup; - f = NULL; + if (cdev->config) { + list_for_each_entry(f, &cdev->config->functions, list) + if (f->req_match && f->req_match(f, ctrl)) + goto try_fun_setup; + f = NULL; + } + switch (ctrl->bRequestType & USB_RECIP_MASK) { case USB_RECIP_INTERFACE: if (!cdev->config || intf >= MAX_CONFIG_INTERFACES) -- 1.7.9.5