Received: by 2002:ad5:4acb:0:0:0:0:0 with SMTP id n11csp3503127imw; Mon, 18 Jul 2022 09:12:54 -0700 (PDT) X-Google-Smtp-Source: AGRyM1usSm9QLUH5InH2LSDcoFmNlcdpHbTeHV+fpWh2IIYkI1kpdSWhyT8pQ5gL3bH+X5iKF1nM X-Received: by 2002:a05:6214:20a2:b0:473:691d:e4ce with SMTP id 2-20020a05621420a200b00473691de4cemr21272786qvd.90.1658160774271; Mon, 18 Jul 2022 09:12:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1658160774; cv=none; d=google.com; s=arc-20160816; b=a/LXO+aCfI3spzc37rvvu+vRG0laDG3rjGB7kDtDeEzlm1eWo14yykn01fapwDaPiA MkKdTEVWNXmjdUKzIXeAAYVup5YffICENVC6diWXsFgEzUGrXlSIaz0P5Rqp8dUPeSxY k7hfCzaTYMbBNp4rrzGW5mwZ0C3L7dbfAz/T3qeEwTf0VTr9ChwRC7AQcePaWke66gLp LH7/at64WCJD8QgdE4qIVb4LtMTqiMy3RwmspPWb1gKP2QtLtGTnrbx3W6tkWOMyRXe+ Flq/a3mahlb29HyMG73/RAlESBh20a/eMhIUY1iBo4SdDsZ99aNyJXDG6uUGDrtmwm37 gm4A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=sL0lNGGOeNqHnnT1vV+CD7QDqzrJOL3j3xEpwxHPFVM=; b=jQI+mEziJZm9R1Y46g9C+Zu5U8HtZIpv4b8X/LqzxBPmwn4DHdBREtd5/sHecMQqwe aLd74zRDYiJ3W/8anf0Oxi/wm3+f4kyr9n+RIpDCal5WOfruR67zK5D7wQc/aLAXkA47 vM8wPwbKmGj1aKkiUokVKE8i+Dom3H2QFUm6CRfpPewUKV4n+HNYh2UNdzJH6HU6nNBs fij6ZupClk7s/zjgM9UuhnmgYqyHM27oAoY6Td+tKiLu2M6omDUw9eynAWi/Kfs4FTL9 CjwVCZ4FabkKKzsFfRm23cVpDpaUiH+LZlndImnHU5B7waWAAa/A9NSFY+ZOceo61V2q BZ1A== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ispras.ru Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id dt4-20020a05620a478400b0069e5ce8c656si407756qkb.512.2022.07.18.09.12.19; Mon, 18 Jul 2022 09:12:54 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ispras.ru Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235480AbiGRQBV (ORCPT + 99 others); Mon, 18 Jul 2022 12:01:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38842 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235325AbiGRQBT (ORCPT ); Mon, 18 Jul 2022 12:01:19 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A519425E86; Mon, 18 Jul 2022 09:01:17 -0700 (PDT) Received: from localhost.localdomain (unknown [83.149.199.65]) by mail.ispras.ru (Postfix) with ESMTPS id 594DE40737DF; Mon, 18 Jul 2022 16:01:11 +0000 (UTC) From: Andrey Strachuk To: Peter Chen Cc: Andrey Strachuk , Pawel Laszczak , Roger Quadros , Aswath Govindraju , Greg Kroah-Hartman , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org Subject: [PATCH v2] usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() Date: Mon, 18 Jul 2022 19:00:52 +0300 Message-Id: <20220718160052.4188-1-strochuk@ispras.ru> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If 'ep' is NULL, result of ep_to_cdns3_ep(ep) is invalid pointer and its dereference with priv_ep->cdns3_dev may cause panic. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Andrey Strachuk Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") --- drivers/usb/cdns3/cdns3-gadget.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c index 5c15c48952a6..aea5db0ec72d 100644 --- a/drivers/usb/cdns3/cdns3-gadget.c +++ b/drivers/usb/cdns3/cdns3-gadget.c @@ -2285,13 +2285,14 @@ static int cdns3_gadget_ep_enable(struct usb_ep *ep, int val; priv_ep = ep_to_cdns3_ep(ep); - priv_dev = priv_ep->cdns3_dev; - comp_desc = priv_ep->endpoint.comp_desc; if (!ep || !desc || desc->bDescriptorType != USB_DT_ENDPOINT) { dev_dbg(priv_dev->dev, "usbss: invalid parameters\n"); return -EINVAL; } + + comp_desc = priv_ep->endpoint.comp_desc; + priv_dev = priv_ep->cdns3_dev; if (!desc->wMaxPacketSize) { dev_err(priv_dev->dev, "usbss: missing wMaxPacketSize\n"); @@ -2600,7 +2601,7 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep, struct usb_request *request) { struct cdns3_endpoint *priv_ep = ep_to_cdns3_ep(ep); - struct cdns3_device *priv_dev = priv_ep->cdns3_dev; + struct cdns3_device *priv_dev; struct usb_request *req, *req_temp; struct cdns3_request *priv_req; struct cdns3_trb *link_trb; @@ -2610,6 +2611,8 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep, if (!ep || !request || !ep->desc) return -EINVAL; + + priv_dev = priv_ep->cdns3_dev; spin_lock_irqsave(&priv_dev->lock, flags); -- 2.25.1