Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932159AbcDHJIN (ORCPT ); Fri, 8 Apr 2016 05:08:13 -0400 Received: from mailgw01.mediatek.com ([210.61.82.183]:19887 "EHLO mailgw01.mediatek.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1757400AbcDHJIL (ORCPT ); Fri, 8 Apr 2016 05:08:11 -0400 From: Chunfeng Yun To: Greg Kroah-Hartman CC: Chunfeng Yun , , , , Subject: [PATCH] usb: core: buffer: avoid NULL pointer dereferrence Date: Fri, 8 Apr 2016 17:08:03 +0800 Message-ID: <1460106483-24793-1-git-send-email-chunfeng.yun@mediatek.com> X-Mailer: git-send-email 1.7.9.5 MIME-Version: 1.0 Content-Type: text/plain X-MTK: N Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1008 Lines: 33 NULL pointer dereferrence will happen when class driver wants to allocate zero length buffer and pool_max[0] can't be used, so skip reserved pool in this case. Signed-off-by: Chunfeng Yun --- drivers/usb/core/buffer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/core/buffer.c b/drivers/usb/core/buffer.c index 2741566..c8f958b 100644 --- a/drivers/usb/core/buffer.c +++ b/drivers/usb/core/buffer.c @@ -131,7 +131,7 @@ void *hcd_buffer_alloc( } for (i = 0; i < HCD_BUFFER_POOLS; i++) { - if (size <= pool_max[i]) + if (pool_max[i] && size <= pool_max[i]) return dma_pool_alloc(hcd->pool[i], mem_flags, dma); } return dma_alloc_coherent(hcd->self.controller, size, dma, mem_flags); @@ -158,7 +158,7 @@ void hcd_buffer_free( } for (i = 0; i < HCD_BUFFER_POOLS; i++) { - if (size <= pool_max[i]) { + if (pool_max[i] && size <= pool_max[i]) { dma_pool_free(hcd->pool[i], addr, dma); return; } -- 1.7.9.5