Commit d43b763e authored Oct 13, 2016 by Nobuo Iwata Committed by Greg Kroah-Hartman Nov 12, 2019

usbip: fix possibility of dereference by NULLL pointer in vhci_hcd.c

commit d79cda045e3bacb7e754a5324cd3d4ce80708eb1 upstream.

This patch fixes possibility of dereference by NULLL pointer in "[PATCH
v5 1/3] usbip: vhci extension: modifications to vhci driver" which has
been merged to 4.9-rc1. It occurs when a URB with pointer to invalid
USB/IP device is enqueued in race condition against detach operation.

A pointer was passed to vdev_to_vhci() before NULL check.
In vdev_to_vhci(), there's a dereference by the pointer.

This patch moves vdev_to_vhci() after NULL check of the pointer.

Signed-off-by: Nobuo Iwata <nobuo.iwata@fujixerox.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent e2aae1a9

drivers/usb/usbip/vhci_hcd.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -465,13 +465,14 @@ static void vhci_tx_urb(struct urb *urb)
		{
		struct vhci_device *vdev = get_vdev(urb->dev);
		struct vhci_priv *priv;
		struct vhci_hcd *vhci = vdev_to_vhci(vdev);
		struct vhci_hcd *vhci;
		unsigned long flags;

		if (!vdev) {
		pr_err("could not get virtual device");
		return;
		}
		vhci = vdev_to_vhci(vdev);

		priv = kzalloc(sizeof(struct vhci_priv), GFP_ATOMIC);
		if (!priv) {