From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752921AbcD1Dmm (ORCPT ); Wed, 27 Apr 2016 23:42:42 -0400 Received: from mailgw01.mediatek.com ([210.61.82.183]:26180 "EHLO mailgw01.mediatek.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1751710AbcD1Dmk (ORCPT ); Wed, 27 Apr 2016 23:42:40 -0400 From: Chunfeng Yun To: Greg Kroah-Hartman CC: Chunfeng Yun , , , , , Felipe Balbi , Alan Stern Subject: [PATCH v2 1/2] usb: core: buffer: avoid NULL pointer dereferrence Date: Thu, 28 Apr 2016 11:42:20 +0800 Message-ID: <1461814941-28345-1-git-send-email-chunfeng.yun@mediatek.com> X-Mailer: git-send-email 1.7.9.5 MIME-Version: 1.0 Content-Type: text/plain X-MTK: N Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org NULL pointer dereferrence will happen when class driver wants to allocate zero length buffer and pool_max[0] can't be used, so simply returns NULL in the case. Signed-off-by: Chunfeng Yun --- drivers/usb/core/buffer.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/core/buffer.c b/drivers/usb/core/buffer.c index 2741566..98e39f9 100644 --- a/drivers/usb/core/buffer.c +++ b/drivers/usb/core/buffer.c @@ -122,6 +122,9 @@ void *hcd_buffer_alloc( struct usb_hcd *hcd = bus_to_hcd(bus); int i; + if (size == 0) + return NULL; + /* some USB hosts just use PIO */ if (!IS_ENABLED(CONFIG_HAS_DMA) || (!bus->controller->dma_mask && -- 1.7.9.5