From patchwork Mon Oct 25 00:33:08 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jim Posen X-Patchwork-Id: 1545772 X-Patchwork-Delegate: trini@ti.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20210112 header.b=Fp+JsFWQ; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4HdG494K2Hz9t1r for ; Tue, 26 Oct 2021 00:28:25 +1100 (AEDT) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 2FAA2834F4; Mon, 25 Oct 2021 15:28:18 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="Fp+JsFWQ"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 9F9EB80F16; Mon, 25 Oct 2021 02:33:17 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,SPF_HELO_NONE, SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 Received: from mail-qt1-x831.google.com (mail-qt1-x831.google.com [IPv6:2607:f8b0:4864:20::831]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 4ADB5815CE for ; Mon, 25 Oct 2021 02:33:14 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=jim.posen@gmail.com Received: by mail-qt1-x831.google.com with SMTP id w8so8887276qts.4 for ; Sun, 24 Oct 2021 17:33:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=WeQwXmwADxYzN418UnpsdBi+Icmxx4PaxFohXH7tH3c=; b=Fp+JsFWQ0AG0hCozLnaxzErX0chaNzypblpAAhMkVdh1HpmJjeKYYCs/D3ehPhHlqK AdxDI1DbreAsCbduHxhak9JP5yWXIQ6ZQQSCDtEynX/mQj7KD5BltB16O1q99F4q87C9 Zg9FFDFToIj9hkOQ66EM9Vl6K1onYr9nptbkW7IU4jzwVgAhdz3ZT/0yv9YsLPIQhjyP xcqBxBbFsFX2ZTgfnEgvKPxj/qzS7xdqHEypXE86wHm2saQEUdGGB5yIB6+yNTAgyGX+ 2ypAfCdEThgGt/GnSZk2wLf5U8KT9b9WtdafLgQ/jrs177Df2sGcdELXUk6e5jXnuFD9 uJHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=WeQwXmwADxYzN418UnpsdBi+Icmxx4PaxFohXH7tH3c=; b=VWeFRFe/irg6G8nfdAz8MY9wO5h8OgvpevcWUFwhOaNUa3TdMe7NbT6WLlxS+jKBw8 RqJiWsRqtnvTa+9o2ZUaerZzUxBpTio4H9gLJCwno2DewM8SWTvkY9QIE/qoWtyd/h34 EJA2g8b+zI5TWgX/GMSVwOfj24aflyd2GdaAt5BhxnfaX6yvGH+JbTGGtYb4pqqcB8kV 8gLeaZRYhsQFf+SGV9vCJdCE0ihmCfPNYKmjRVok24vhkgzTDfj1XWsW4UKuHTacI1NJ wgsnOuxaYYUuZ5ZOMqR/jO5ALGqzuUDd03GJYOUimqIZoJTJ7bJTLn+8E8nyIpk9VGR8 P1kg== X-Gm-Message-State: AOAM531nbGBH3xZgmlM7R8MfktIsR2qZze8rUUwOKu1hyzKA7jrjSfhi Kqc6ICnzIdDJT6gpYz0TEwCk1kGVdZ8= X-Google-Smtp-Source: ABdhPJxYZUax4kFikGQJfNZAayE4dfM2yLldgAaoT+cy0xKnIR/sLZOX8qEMTLnmA72R9meQB6YofA== X-Received: by 2002:ac8:430e:: with SMTP id z14mr14211087qtm.208.1635121992640; Sun, 24 Oct 2021 17:33:12 -0700 (PDT) Received: from phantom.myfiosgateway.com ([68.237.40.64]) by smtp.gmail.com with ESMTPSA id o190sm7804708qka.16.2021.10.24.17.33.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 24 Oct 2021 17:33:12 -0700 (PDT) From: Jim Posen To: u-boot@lists.denx.de Cc: Jim Posen , Bin Meng , Marek Vasut Subject: [PATCH] Avoid possible NULL dereference in XHCI driver Date: Sun, 24 Oct 2021 20:33:08 -0400 Message-Id: <20211025003308.1931014-1-jim.posen@gmail.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Mailman-Approved-At: Mon, 25 Oct 2021 15:28:16 +0200 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean In the recovery function abort_td run after timed out XHCI transfers, there's a possible NULL pointer dereference. Instead, explicitly BUG_ON that condition. Signed-off-by: Jim Posen --- drivers/usb/host/xhci-ring.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 35bd5cd29e..1635d03ece 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -499,6 +499,7 @@ static void abort_td(struct usb_device *udev, int ep_index) xhci_queue_command(ctrl, NULL, udev->slot_id, ep_index, TRB_STOP_RING); event = xhci_wait_for_event(ctrl, TRB_TRANSFER); + BUG_ON(!event); field = le32_to_cpu(event->trans_event.flags); BUG_ON(TRB_TO_SLOT_ID(field) != udev->slot_id); BUG_ON(TRB_TO_EP_INDEX(field) != ep_index);