From d79cda045e3bacb7e754a5324cd3d4ce80708eb1 Mon Sep 17 00:00:00 2001 From: Nobuo Iwata Date: Thu, 13 Oct 2016 12:49:02 +0900 Subject: usbip: fix possibility of dereference by NULLL pointer in vhci_hcd.c This patch fixes possibility of dereference by NULLL pointer in "[PATCH v5 1/3] usbip: vhci extension: modifications to vhci driver" which has been merged to 4.9-rc1. It occurs when a URB with pointer to invalid USB/IP device is enqueued in race condition against detach operation. A pointer was passed to vdev_to_vhci() before NULL check. In vdev_to_vhci(), there's a dereference by the pointer. This patch moves vdev_to_vhci() after NULL check of the pointer. Signed-off-by: Nobuo Iwata Signed-off-by: Greg Kroah-Hartman --- drivers/usb/usbip/vhci_hcd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/usb/usbip/vhci_hcd.c') diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c index 03eccf29ace0..c4724fb3a691 100644 --- a/drivers/usb/usbip/vhci_hcd.c +++ b/drivers/usb/usbip/vhci_hcd.c @@ -460,13 +460,14 @@ static void vhci_tx_urb(struct urb *urb) { struct vhci_device *vdev = get_vdev(urb->dev); struct vhci_priv *priv; - struct vhci_hcd *vhci = vdev_to_vhci(vdev); + struct vhci_hcd *vhci; unsigned long flags; if (!vdev) { pr_err("could not get virtual device"); return; } + vhci = vdev_to_vhci(vdev); priv = kzalloc(sizeof(struct vhci_priv), GFP_ATOMIC); if (!priv) { -- cgit v1.2.3