From:   Pawel Laszczak <pawell@cadence.com>
To:     Zhou Qingyang <zhou1615@umn.edu>
CC:     "kjlu@umn.edu" <kjlu@umn.edu>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        "peter.chen@kernel.org" <peter.chen@kernel.org>,
        "linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH] usb: cdnsp: Fix a NULL pointer dereference in
 cdnsp_endpoint_init()
Thread-Topic: [PATCH] usb: cdnsp: Fix a NULL pointer dereference in
 cdnsp_endpoint_init()
Thread-Index: AQHX5g+EScFJGN+g50SE4yK10NJi+qwdPKoggAADLjA=
Date:   Wed, 1 Dec 2021 07:39:05 +0000
Message-ID: <BYAPR07MB53815000E619C1E80BFFD275DD689@BYAPR07MB5381.namprd07.prod.outlook.com>
References: <20211130172700.206650-1-zhou1615@umn.edu>
 <BYAPR07MB5381BE5297FA4905E8BD40C0DD689@BYAPR07MB5381.namprd07.prod.outlook.com>
In-Reply-To: <BYAPR07MB5381BE5297FA4905E8BD40C0DD689@BYAPR07MB5381.namprd07.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?VTB9RqBhTvNNVXUoGJq66gJmIkHpzj8sdZXjZgo/LYfem9naAKyqEA1Ie9Tb?=
 =?us-ascii?Q?8+pxamZikKGSh1SyZNdeNUw1KcVbQ4IYVeFG4PcO0OItBUkhrub0rBYebuXv?=
 =?us-ascii?Q?kn7OW47n+JDWUO5kNFrKFqtAFIDPW+K92i6FfXxWuEfOL5jehdTVXkwgTdMT?=
 =?us-ascii?Q?B+xPEtC762smDSyXbfQiJRvtyKkj9GX+994n5TBXkNhleqdeLALRuKQfX4WH?=
 =?us-ascii?Q?Lyg5nVVt3b/l0TUXIZAA350OiYDKD12MmAdl3X0o7N6uEdsN6hPMWB2BEzuZ?=
 =?us-ascii?Q?guEhGp43ANYk0exXlyC1VoIiS4pl+ia39MEJVeZMVy3LaiS6/EiJBod+8UU2?=
 =?us-ascii?Q?YtPnMKZjK+1hnHJNwUu1UET5Y/yiCYOuySB8SSmspgf3++IufBUkpeoFy/H3?=
 =?us-ascii?Q?lncRazV23JTi58StFfoyJQCApRfXFjyuVD1jBw0XbOjZjIXJTxzbg+0jBWVe?=
 =?us-ascii?Q?SheB1b+8FhxLMwYF0CkctfRLr3kZrgETCeUt/0y/4j6oovl7Q47h2SzhsdLK?=
 =?us-ascii?Q?ppx44Ifih+pgvrPJD5LLT83YkH4DuIlwfUuCW4c71cMlay+TokYfv19W6C0D?=
 =?us-ascii?Q?k/dXx4zVfcrr3ip7OrHOah3Q+8n9BM0pteqkW+9Yh/Y7e8meP2kQa3ZeDahH?=
 =?us-ascii?Q?lkgygEceJMgsAK5LnWveNYa9VV/Gd4s77Cd0eFxwjp8xLJ8u0mbLM/zc3dYO?=
 =?us-ascii?Q?7qwAW1PgkLU92eYwWLGHf8rrzElGcGqGUCYgpEsGq2WxgA+4imLzjxRbGwS5?=
 =?us-ascii?Q?3mmJhn3pgYM3TEjFnlxg5VTweO+u3iRCv8CcoNoBq5Ur0XWMco39NPVjM7pb?=
 =?us-ascii?Q?oWdcNy0ttTMTbGPA2moMfg24xZaH201DUyvtGpetPpPBB3E/nUZXr3Y1oj6/?=
 =?us-ascii?Q?dfZDJXjznZrWxaqNQRL+9MvoLpRRXcVVUQDtpcmj85b2MLF+Y2OZDNtRG3pW?=
 =?us-ascii?Q?eCcGFrmjGjWHq+C3bqalu5PsJsQzRzv6k4WGAowr6k0abAWn7d/4aA200S2B?=
 =?us-ascii?Q?TeisWrKv9R4KQq7DeFt8eXj1TZgd+NtAvwEKZJyAJNUyv693JibAc5wODRns?=
 =?us-ascii?Q?NmzZBYLmHuaDxjvx58q+u/GqJE4gxSOyirX/A2fuJ+yP0Uj9RZ0OJU66GAu3?=
 =?us-ascii?Q?7AjoYnqLOrs/A8oUCZJMAaW+ifCBHl8FX0DWXBDhRUtl1vAiLy3qtkWHmkJB?=
 =?us-ascii?Q?PTqhU63yQ/b+hnk7j1M7xvW6QGyVZsHHmNGnHCAzEDGlMVN/g6ty6dBAT3QK?=
 =?us-ascii?Q?ZzRVxW2k/mCzsHrnbUvA10IDZ5KGJckRdFMq3w3NhT17OHdkyIo1fjE/xakw?=
 =?us-ascii?Q?bwiXuFc8z7mXe78PTZRtOqeUYU5uZSq/q6IhORS7NvAgxRwEIvnW3Djb84LS?=
 =?us-ascii?Q?1r0eHiPO9SHmm7AVHZtY6dsfywXvz9ZQZd2cW+VGjMkAnDi31UUjZBEoanHb?=
 =?us-ascii?Q?1NwNMeIR+HmWlYoCEYURVOlzP6V0zu6VMALMeS/dqfvi9vc2i2579PfIEWHy?=
 =?us-ascii?Q?0B+1FUT3yRiFabbxZsKvyrdIlavisTGTe3KPmwPElJIv4BYvD4e56fiiAEmU?=
 =?us-ascii?Q?NItWmUsNAK99lTyN5KXPjKGx9P3MQLuIMFWxuyaVbFFKmhGZQsxwsZD/cbId?=
 =?us-ascii?Q?5iAaGxzIY2ccXrMOiGoPEBWY/hcFIEWb8/9mVJy+eD2zbWZZCUpM19zx1JnA?=
 =?us-ascii?Q?5Xq9+g=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: cadence.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BYAPR07MB5381.namprd07.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 053f82bc-b481-4dac-9923-08d9b49da74c
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Dec 2021 07:39:05.8126
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d36035c5-6ce6-4662-a3dc-e762e61ae4c9
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 8FCnlAp3K11QC5GgWnhgZe08MZjmM6kswQOGtcUppKTJJRZBSDD7TXkp/Ge6PmzaHUv7Su15Y7EyyUNQ7GUeXXseXpfqEoYlnNpsUZOKIwg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR07MB7568
X-Proofpoint-GUID: WqwK5vmreq-Yt9ZJ5E88BoGjl_yY6vBq
X-Proofpoint-ORIG-GUID: WqwK5vmreq-Yt9ZJ5E88BoGjl_yY6vBq
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.790,Hydra:6.0.425,FMLib:17.0.607.475
 definitions=2021-11-30_10,2021-11-28_01,2020-04-07_01
X-Proofpoint-Spam-Details: rule=outbound_check_notspam policy=outbound_check score=0 adultscore=0
 suspectscore=0 phishscore=0 malwarescore=0 lowpriorityscore=0
 mlxlogscore=999 mlxscore=0 impostorscore=0 priorityscore=1501 spamscore=0
 clxscore=1011 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2110150000 definitions=main-2112010043
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Only fixed Peter Chen address email:
peter.chen@nxp.com  doesn't exist, should be peter.chen@kernel.org

>-----Original Message-----
>From: Pawel Laszczak
>Sent: Wednesday, December 1, 2021 8:28 AM
>To: Zhou Qingyang <zhou1615@umn.edu>
>Cc: kjlu@umn.edu; Greg Kroah-Hartman <gregkh@linuxfoundation.org>; Peter C=
hen <peter.chen@nxp.com>; linux-
>usb@vger.kernel.org; linux-kernel@vger.kernel.org
>Subject: RE: [PATCH] usb: cdnsp: Fix a NULL pointer dereference in cdnsp_e=
ndpoint_init()
>
>>
>>In cdnsp_endpoint_init(), cdnsp_ring_alloc() is assigned to pep->ring
>>and there is a dereference of it in cdnsp_endpoint_init(), which could
>>lead to a NULL pointer dereference on failure of cdnsp_ring_alloc().
>>
>>Fix this bug by adding a check of pep->ring.
>>
>>This bug was found by a static analyzer. The analysis employs
>>differential checking to identify inconsistent security operations
>>(e.g., checks or kfrees) between two code paths and confirms that the
>>inconsistent operations are not recovered in the current function or
>>the callers, so they constitute bugs.
>>
>>Note that, as a bug found by static analysis, it can be a false
>>positive or hard to trigger. Multiple researchers have cross-reviewed
>>the bug.
>>
>>Builds with CONFIG_USB_CDNSP_GADGET=3Dy show no new warnings,
>>and our static analyzer no longer warns about this code.
>>
>>Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP D=
RD Driver")
>>Signed-off-by: Zhou Qingyang <zhou1615@umn.edu>
>>---
>> drivers/usb/cdns3/cdnsp-mem.c | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>>diff --git a/drivers/usb/cdns3/cdnsp-mem.c b/drivers/usb/cdns3/cdnsp-mem.=
c
>>index ad9aee3f1e39..97866bfb2da9 100644
>>--- a/drivers/usb/cdns3/cdnsp-mem.c
>>+++ b/drivers/usb/cdns3/cdnsp-mem.c
>>@@ -987,6 +987,9 @@ int cdnsp_endpoint_init(struct cdnsp_device *pdev,
>>
>> 	/* Set up the endpoint ring. */
>> 	pep->ring =3D cdnsp_ring_alloc(pdev, 2, ring_type, max_packet, mem_flag=
s);
>>+	if (!pep->ring)
>>+		return -ENOMEM;
>>+
>> 	pep->skip =3D false;
>>
>> 	/* Fill the endpoint context */
>>--
>>2.25.1
>
>
>Acked-by: Pawel Laszczak <pawell@cadence.com>
>
>--
>
>Thanks,
>Pawel Laszczak