[PATCH] usbip: add NULL check for calloc in do_standalone_mode

[PATCH] usbip: add NULL check for calloc in do_standalone_mode

[longlong yan]

Add a NULL check for the return value of calloc() in
do_standalone_mode(). If calloc() fails and returns NULL, the
subsequent access to fds[i].fd would cause a NULL pointer
dereference.

Signed-off-by: longlong yan <yanlonglong@kylinos.cn>
---
 tools/usb/usbip/src/usbipd.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/usb/usbip/src/usbipd.c b/tools/usb/usbip/src/usbipd.c
index 3e22b651c754..dbc2b48363b2 100644
--- a/tools/usb/usbip/src/usbipd.c
+++ b/tools/usb/usbip/src/usbipd.c
@@ -544,6 +544,11 @@ static int do_standalone_mode(int daemonize, int ipv4, int ipv6)
 	dbg("listening on %d address%s", nsockfd, (nsockfd == 1) ? "" : "es");
 
 	fds = calloc(nsockfd, sizeof(struct pollfd));
+	if (!fds) {
+		err("calloc for pollfd");
+		usbip_driver_close(driver);
+		return -1;
+	}
 	for (i = 0; i < nsockfd; i++) {
 		fds[i].fd = sockfdlist[i];
 		fds[i].events = POLLIN;
-- 
2.43.0

Re: [PATCH] usbip: add NULL check for calloc in do_standalone_mode

[Shuah Khan]

On 8/17/26 00:15, longlong yan wrote:
> Add a NULL check for the return value of calloc() in
> do_standalone_mode(). If calloc() fails and returns NULL, the
> subsequent access to fds[i].fd would cause a NULL pointer
> dereference.
> 
> Signed-off-by: longlong yan <yanlonglong@kylinos.cn>
> ---
>   tools/usb/usbip/src/usbipd.c | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/tools/usb/usbip/src/usbipd.c b/tools/usb/usbip/src/usbipd.c
> index 3e22b651c754..dbc2b48363b2 100644
> --- a/tools/usb/usbip/src/usbipd.c
> +++ b/tools/usb/usbip/src/usbipd.c
> @@ -544,6 +544,11 @@ static int do_standalone_mode(int daemonize, int ipv4, int ipv6)
>   	dbg("listening on %d address%s", nsockfd, (nsockfd == 1) ? "" : "es");
>   
>   	fds = calloc(nsockfd, sizeof(struct pollfd));
> +	if (!fds) {
> +		err("calloc for pollfd");
> +		usbip_driver_close(driver);
> +		return -1;
> +	}
>   	for (i = 0; i < nsockfd; i++) {
>   		fds[i].fd = sockfdlist[i];
>   		fds[i].events = POLLIN;

It is theoretically possible for calloc() to fail, however how often
does it fail and were you able to make this allocation to fail?

If not, how did you test this patch? In any case, I am not going to
take this patch and all the other patches you sent adding checks to
calloc() calls in other places in usbip tool.

thanks,
-- Shuah