Received: by 2002:ac0:e34a:0:0:0:0:0 with SMTP id g10csp150184imn; Wed, 27 Jul 2022 02:24:32 -0700 (PDT) X-Google-Smtp-Source: AGRyM1uf8KNUPpz8jhadFFhiJ/CQUp//jAPpVqyJwEdiwzBW+skRWZwTMJSYkbVAwXuH2hkzmn4X X-Received: by 2002:a05:6a00:b8c:b0:52c:4a92:d133 with SMTP id g12-20020a056a000b8c00b0052c4a92d133mr1276731pfj.74.1658913872453; Wed, 27 Jul 2022 02:24:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1658913872; cv=none; d=google.com; s=arc-20160816; b=x8G9o+QH8UZ3NUzS3BYZR1whwd08Aa3T9ISu1sUoyfMyrxjLG5YLWIIWgagXrNbNWp rYss+GMhkjeDzk5S8KV2IEXcxDsNfbaZJFUw6F9PESvmXwkUYarh2GqaPL7aRjRvlfCn Kpb9LX/olmjBa2Xh8VY4n9brQb8aAU/vbkfRCEORE8KYLmbn+531q109VtCWjaqcA0zu DcilZqv0soA7Xsc12KovZSHbBFt+JZkaCRGv3uEBmj7pfwIxyLfSygdGU880OraMskTY XDW5ZYyb9xYb0yJGmUbLbTqlMPWxYZmhAY2p5ysPqw5wNa9NArTgG5XIatpFJP/gKznP 2UYg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:in-reply-to:content-disposition:mime-version :references:message-id:subject:cc:to:from:date:dkim-signature; bh=nGZJDaC5zir9PkRZlpuWvQYW1Gku/uSNjp8yLALqyQc=; b=kEI7l1nBesmwHhbNdKS8m+R4H5hHyNi5AG1UbCGfLYOqChP8clnWvEo5SjQedTC9eA oBglECcDjqVSUIGVGKuya17MXn3r8Vhityl+X39cjkjIIutwwkxFzOgpAOZK5Uxh4Kxw WkPA9tMRvssYgByA6czB+qCgpkwDO03fQiG65FrAyk90zq7ux1RI4P2oPXC06RMepvMw aLDsZsK+Th4VTx8ErDQMDxaAPfcq67NzrQUsQVm5YijA12Yjlsa8zfriK3YUPegQW6hV kquf81t2rSIadx4es+P8sOaVObHwuh6UHxR8B3gz29Vj2+mLfGXwngklemtRMePTZ7yR 2oxQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=hFavDORN; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id o2-20020a639202000000b0041a4a97d588si19952352pgd.588.2022.07.27.02.24.17; Wed, 27 Jul 2022 02:24:32 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=hFavDORN; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230241AbiG0IkI (ORCPT + 99 others); Wed, 27 Jul 2022 04:40:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56014 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229484AbiG0IkG (ORCPT ); Wed, 27 Jul 2022 04:40:06 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 32435459B3; Wed, 27 Jul 2022 01:40:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E8AC1B81F86; Wed, 27 Jul 2022 08:40:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8E7E5C433D6; Wed, 27 Jul 2022 08:40:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1658911202; bh=tIWFLtMJyA0WvBIj310rvSlNj7MTChe0+yS1av3aX5s=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=hFavDORN53dDQcWjAsJD6akPrDEgQ9XP5Y1+JAlzxwS+VHZzphAMfQawE4QcfuaJ3 yN0AQvnCZYiOw8+NoGmkB33QMfDN5VvAwAxdJZKSyjNSnZh8q5k/vxSHhKUKri2Ywr 5xsDcwVXZRo7ppOQxU7c+I67oSPxDI2wNFfs4205iTjWPLSWZ5rnFcA2aYyq+UE0MU evCpgbqMFd32YKoGkUuRk3Hz+BIM+8SeDDJvvn7CUu91mtRaYe9dAK8cyxrTte232E VEoUk/fUzbCkM9S87to5mkJ3wXlGAOv7GYnnrWiUVZ72idHrxrPY8LgcRAeG05bLIf AVG7Oju1zSXjA== Date: Wed, 27 Jul 2022 16:39:56 +0800 From: Peter Chen To: Andrey Strachuk Cc: Pawel Laszczak , Roger Quadros , Aswath Govindraju , Greg Kroah-Hartman , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org Subject: Re: [PATCH v2] usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() Message-ID: <20220727083956.GA269370@nchen-desktop> References: <20220718160052.4188-1-strochuk@ispras.ru> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220718160052.4188-1-strochuk@ispras.ru> X-Spam-Status: No, score=-7.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 22-07-18 19:00:52, Andrey Strachuk wrote: > If 'ep' is NULL, result of ep_to_cdns3_ep(ep) is invalid pointer > and its dereference with priv_ep->cdns3_dev may cause panic. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Signed-off-by: Andrey Strachuk > Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") > --- > drivers/usb/cdns3/cdns3-gadget.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c > index 5c15c48952a6..aea5db0ec72d 100644 > --- a/drivers/usb/cdns3/cdns3-gadget.c > +++ b/drivers/usb/cdns3/cdns3-gadget.c > @@ -2285,13 +2285,14 @@ static int cdns3_gadget_ep_enable(struct usb_ep *ep, > int val; > > priv_ep = ep_to_cdns3_ep(ep); > - priv_dev = priv_ep->cdns3_dev; > - comp_desc = priv_ep->endpoint.comp_desc; > > if (!ep || !desc || desc->bDescriptorType != USB_DT_ENDPOINT) { > dev_dbg(priv_dev->dev, "usbss: invalid parameters\n"); > return -EINVAL; > } > + > + comp_desc = priv_ep->endpoint.comp_desc; > + priv_dev = priv_ep->cdns3_dev; > > if (!desc->wMaxPacketSize) { > dev_err(priv_dev->dev, "usbss: missing wMaxPacketSize\n"); > @@ -2600,7 +2601,7 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep, > struct usb_request *request) > { > struct cdns3_endpoint *priv_ep = ep_to_cdns3_ep(ep); > - struct cdns3_device *priv_dev = priv_ep->cdns3_dev; > + struct cdns3_device *priv_dev; > struct usb_request *req, *req_temp; > struct cdns3_request *priv_req; > struct cdns3_trb *link_trb; > @@ -2610,6 +2611,8 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep, > > if (!ep || !request || !ep->desc) > return -EINVAL; > + > + priv_dev = priv_ep->cdns3_dev; > > spin_lock_irqsave(&priv_dev->lock, flags); > > -- Acked-by: Peter Chen -- Thanks, Peter Chen