diff mbox series

usb: core: Prevent null pointer dereference in update_port_device_state

Message ID 20240104102616.20120-1-quic_ugoswami@quicinc.com
State New
Headers show
Series usb: core: Prevent null pointer dereference in update_port_device_state | expand

Commit Message

Udipto Goswami Jan. 4, 2024, 10:26 a.m. UTC
Currently,the function update_port_device_state gets the usb_hub from
udev->parent by calling usb_hub_to_struct_hub.
However, in case the actconfig or the maxchild is 0, the usb_hub would
be NULL and upon further accessing to get port_dev would result in null
pointer dereference.

Fix this by introducing an if check after the usb_hub is populated.

Fixes: 83cb2604f641 ("usb: core: add sysfs entry for usb device state")
Signed-off-by: Udipto Goswami <quic_ugoswami@quicinc.com>
---
 drivers/usb/core/hub.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

Comments

Greg KH Jan. 4, 2024, 1:13 p.m. UTC | #1
On Thu, Jan 04, 2024 at 06:35:38PM +0530, Udipto Goswami wrote:
> Hi Greg,
> 
> On 1/4/2024 4:14 PM, Greg Kroah-Hartman wrote:
> > On Thu, Jan 04, 2024 at 03:56:16PM +0530, Udipto Goswami wrote:
> > > Currently,the function update_port_device_state gets the usb_hub from
> > > udev->parent by calling usb_hub_to_struct_hub.
> > > However, in case the actconfig or the maxchild is 0, the usb_hub would
> > > be NULL and upon further accessing to get port_dev would result in null
> > > pointer dereference.
> > 
> > Is this true for any real (or fake) hardware?
> 
> We saw this in our QCOM hardwares where lvstest.c was calling
> get_dev_desc_store:
> 
> 	usb_set_device_state+0x128/0x17c
> 	create_lvs_device+0x60/0xf8 [lvstest]
> 	get_dev_desc_store+0x94/0x18c [lvstest]
> 	dev_attr_store+0x30/0x48
> 
> I think the part of the test procedure is to first unbind the hub driver
> which calls hub_disconnect setting the maxchild = 0.

Are you sure lvstest is correct here?

thanks,

greg k-h
Alan Stern Jan. 4, 2024, 2:56 p.m. UTC | #2
On Thu, Jan 04, 2024 at 02:13:51PM +0100, Greg Kroah-Hartman wrote:
> On Thu, Jan 04, 2024 at 06:35:38PM +0530, Udipto Goswami wrote:
> > Hi Greg,
> > 
> > On 1/4/2024 4:14 PM, Greg Kroah-Hartman wrote:
> > > On Thu, Jan 04, 2024 at 03:56:16PM +0530, Udipto Goswami wrote:
> > > > Currently,the function update_port_device_state gets the usb_hub from
> > > > udev->parent by calling usb_hub_to_struct_hub.
> > > > However, in case the actconfig or the maxchild is 0, the usb_hub would
> > > > be NULL and upon further accessing to get port_dev would result in null
> > > > pointer dereference.
> > > 
> > > Is this true for any real (or fake) hardware?
> > 
> > We saw this in our QCOM hardwares where lvstest.c was calling
> > get_dev_desc_store:
> > 
> > 	usb_set_device_state+0x128/0x17c
> > 	create_lvs_device+0x60/0xf8 [lvstest]
> > 	get_dev_desc_store+0x94/0x18c [lvstest]
> > 	dev_attr_store+0x30/0x48
> > 
> > I think the part of the test procedure is to first unbind the hub driver
> > which calls hub_disconnect setting the maxchild = 0.
> 
> Are you sure lvstest is correct here?

This is what happens when people work behind the hub driver's back.  :-(

If you can't find another way to fix the problem, you should at least 
change the patch to include a comment before the "if (hub)" test, 
explaining why it is necessary.  Otherwise somebody in the future will 
remove the test, because under normal circumstances hub would never be 
NULL here.

Alan Stern
diff mbox series

Patch

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index ffd7c99e24a3..c33ff37159c2 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2053,9 +2053,11 @@  static void update_port_device_state(struct usb_device *udev)
 
 	if (udev->parent) {
 		hub = usb_hub_to_struct_hub(udev->parent);
-		port_dev = hub->ports[udev->portnum - 1];
-		WRITE_ONCE(port_dev->state, udev->state);
-		sysfs_notify_dirent(port_dev->state_kn);
+		if (hub) {
+			port_dev = hub->ports[udev->portnum - 1];
+			WRITE_ONCE(port_dev->state, udev->state);
+			sysfs_notify_dirent(port_dev->state_kn);
+		}
 	}
 }