| Message ID | 20210303095826.6143-1-colin.king@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | usb: dwc3: Fix dereferencing of null dwc->usb_psy | expand |
On Wed, Mar 3, 2021 at 6:00 PM Colin King <colin.king@canonical.com> wrote: > > From: Colin Ian King <colin.king@canonical.com> > > Currently the null check logic on dwc->usb_psy is inverted as it allows > calls to power_supply_put with a null dwc->usb_psy causing a null > pointer dereference. Fix this by removing the ! operator. > > Addresses-Coverity: ("Dereference after null check") > Fixes: 59fa3def35de ("usb: dwc3: add a power supply for current control") Acked-by: Ray Chi <raychi@google.com> > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > drivers/usb/dwc3/core.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c > index d15f065849cd..94fdbe502ce9 100644 > --- a/drivers/usb/dwc3/core.c > +++ b/drivers/usb/dwc3/core.c > @@ -1628,7 +1628,7 @@ static int dwc3_probe(struct platform_device *pdev) > assert_reset: > reset_control_assert(dwc->reset); > > - if (!dwc->usb_psy) > + if (dwc->usb_psy) > power_supply_put(dwc->usb_psy); > > return ret; > @@ -1653,7 +1653,7 @@ static int dwc3_remove(struct platform_device *pdev) > dwc3_free_event_buffers(dwc); > dwc3_free_scratch_buffers(dwc); > > - if (!dwc->usb_psy) > + if (dwc->usb_psy) > power_supply_put(dwc->usb_psy); > > return 0; > -- > 2.30.0 > Thanks for fixing this bug! Regards, Ray
Hi all, > On Wed, Mar 3, 2021 at 6:00 PM Colin King <colin.king@canonical.com> wrote: >> >> From: Colin Ian King <colin.king@canonical.com> >> >> Currently the null check logic on dwc->usb_psy is inverted as it allows >> calls to power_supply_put with a null dwc->usb_psy causing a null >> pointer dereference. Fix this by removing the ! operator. >> >> Addresses-Coverity: ("Dereference after null check") >> Fixes: 59fa3def35de ("usb: dwc3: add a power supply for current control") > > Acked-by: Ray Chi <raychi@google.com> > >> Signed-off-by: Colin Ian King <colin.king@canonical.com> Tested-by: Heiko Thiery <heiko.thiery@gmail.com> >> --- >> drivers/usb/dwc3/core.c | 4 ++-- >> 1 file changed, 2 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c >> index d15f065849cd..94fdbe502ce9 100644 >> --- a/drivers/usb/dwc3/core.c >> +++ b/drivers/usb/dwc3/core.c >> @@ -1628,7 +1628,7 @@ static int dwc3_probe(struct platform_device *pdev) >> assert_reset: >> reset_control_assert(dwc->reset); >> >> - if (!dwc->usb_psy) >> + if (dwc->usb_psy) >> power_supply_put(dwc->usb_psy); >> >> return ret; >> @@ -1653,7 +1653,7 @@ static int dwc3_remove(struct platform_device *pdev) >> dwc3_free_event_buffers(dwc); >> dwc3_free_scratch_buffers(dwc); >> >> - if (!dwc->usb_psy) >> + if (dwc->usb_psy) >> power_supply_put(dwc->usb_psy); >> >> return 0; >> -- >> 2.30.0 >> Thank you. -- Heiko
On 03/03/2021 21:29, Heiko Thiery wrote: > Hi all, > >> On Wed, Mar 3, 2021 at 6:00 PM Colin King <colin.king@canonical.com> wrote: >>> >>> From: Colin Ian King <colin.king@canonical.com> >>> >>> Currently the null check logic on dwc->usb_psy is inverted as it allows >>> calls to power_supply_put with a null dwc->usb_psy causing a null >>> pointer dereference. Fix this by removing the ! operator. >>> >>> Addresses-Coverity: ("Dereference after null check") >>> Fixes: 59fa3def35de ("usb: dwc3: add a power supply for current control") >> >> Acked-by: Ray Chi <raychi@google.com> >> >>> Signed-off-by: Colin Ian King <colin.king@canonical.com> > > Tested-by: Heiko Thiery <heiko.thiery@gmail.com> Thanks for testing. Much appreciated. Colin > >>> --- >>> drivers/usb/dwc3/core.c | 4 ++-- >>> 1 file changed, 2 insertions(+), 2 deletions(-) >>> >>> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c >>> index d15f065849cd..94fdbe502ce9 100644 >>> --- a/drivers/usb/dwc3/core.c >>> +++ b/drivers/usb/dwc3/core.c >>> @@ -1628,7 +1628,7 @@ static int dwc3_probe(struct platform_device *pdev) >>> assert_reset: >>> reset_control_assert(dwc->reset); >>> >>> - if (!dwc->usb_psy) >>> + if (dwc->usb_psy) >>> power_supply_put(dwc->usb_psy); >>> >>> return ret; >>> @@ -1653,7 +1653,7 @@ static int dwc3_remove(struct platform_device *pdev) >>> dwc3_free_event_buffers(dwc); >>> dwc3_free_scratch_buffers(dwc); >>> >>> - if (!dwc->usb_psy) >>> + if (dwc->usb_psy) >>> power_supply_put(dwc->usb_psy); >>> >>> return 0; >>> -- >>> 2.30.0 >>> > > Thank you. >
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c index d15f065849cd..94fdbe502ce9 100644 --- a/drivers/usb/dwc3/core.c +++ b/drivers/usb/dwc3/core.c @@ -1628,7 +1628,7 @@ static int dwc3_probe(struct platform_device *pdev) assert_reset: reset_control_assert(dwc->reset); - if (!dwc->usb_psy) + if (dwc->usb_psy) power_supply_put(dwc->usb_psy); return ret; @@ -1653,7 +1653,7 @@ static int dwc3_remove(struct platform_device *pdev) dwc3_free_event_buffers(dwc); dwc3_free_scratch_buffers(dwc); - if (!dwc->usb_psy) + if (dwc->usb_psy) power_supply_put(dwc->usb_psy); return 0;