[PATCH] usbip: usbip_host: Fix null pointer dereference in rebind_store
Jeffin Philip <[email protected]>
| Newsgroups | org.kernel.vger.stable,org.kernel.vger.linux-kernel,org.kernel.vger.linux-usb |
|---|---|
| Message-ID | <[email protected]> |
rebind_store calls do_rebind which dereferences udev without checking if it is NULL. If busid is registered using match_busid but the device is not present in the first place, it triggers a null pointer dereference when we attempt to rebind the device. Fix this by checking explicitly for udev first and returning -ENODEV if udev is NULL. Reported-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=af76b01c9a0f0ab60fb0 Fixes: 4bfb141bc013 ("usbip: usbip_host: fix to hold parent lock for device_attach() calls") Cc: [email protected] Signed-off-by: Jeffin Philip <[email protected]> --- drivers/usb/usbip/stub_main.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c index 79110a69d697..dfaedecedb81 100644 --- a/drivers/usb/usbip/stub_main.c +++ b/drivers/usb/usbip/stub_main.c @@ -256,6 +256,11 @@ static ssize_t rebind_store(struct device_driver *dev, const char *buf, if (!bid) return -ENODEV; + if (!bid->udev) { + put_busid_priv(bid); + return -ENODEV; + } + /* mark the device for deletion so probe ignores it during rescan */ bid->status = STUB_BUSID_OTHER; /* release the busid lock */ -- 2.55.0