summaryrefslogtreecommitdiffstats
path: root/drivers/usb
diff options
context:
space:
mode:
authorJia-Ju Bai <baijiaju1990@gmail.com>2019-05-22 14:33:58 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-05-22 14:25:37 +0200
commit5bce256f0b528624a34fe907db385133bb7be33e (patch)
treecbfcd8ee20b9e720cc4f8a1a752e3b106ae5a065 /drivers/usb
parent597c56e372dab2c7f79b8d700aad3a5deebf9d1b (diff)
downloadlinux-5bce256f0b528624a34fe907db385133bb7be33e.tar.bz2
usb: xhci: Fix a potential null pointer dereference in xhci_debugfs_create_endpoint()
In xhci_debugfs_create_slot(), kzalloc() can fail and dev->debugfs_private will be NULL. In xhci_debugfs_create_endpoint(), dev->debugfs_private is used without any null-pointer check, and can cause a null pointer dereference. To fix this bug, a null-pointer check is added in xhci_debugfs_create_endpoint(). This bug is found by a runtime fuzzing tool named FIZZER written by us. [subjet line change change, add potential -Mathais] Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb')
-rw-r--r--drivers/usb/host/xhci-debugfs.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
index cadc01336bf8..7ba6afc7ef23 100644
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -440,6 +440,9 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci,
struct xhci_ep_priv *epriv;
struct xhci_slot_priv *spriv = dev->debugfs_private;
+ if (!spriv)
+ return;
+
if (spriv->eps[ep_index])
return;