Re: Re: [PATCH] usb: cdns3: Fix potential dereference of NULL pointer

[刘永志]

> -----Original Messages-----
> From: "Greg KH" <gregkh@xxxxxxxxxxxxxxxxxxx>
> Sent Time: 2022-05-20 00:07:17 (Friday)
> To: "Yongzhi Liu" <lyz_cs@xxxxxxxxxx>
> Cc: peter.chen@xxxxxxxxxx, pawell@xxxxxxxxxxx, rogerq@xxxxxxxxxx, a-govindraju@xxxxxx, felipe.balbi@xxxxxxxxxxxxxxx, linux-usb@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, fuyq@xxxxxxxxxxxxxx
> Subject: Re: [PATCH] usb: cdns3:  Fix potential dereference of NULL pointer
> 
> On Wed, May 18, 2022 at 01:12:50AM -0700, Yongzhi Liu wrote:
> > The return value of cdns3_gadget_ep_alloc_request()
> > needs to be checked to avoid use of NULL pointer
> > in case of an allocation failure.
> > 
> > Fixes: 7733f6c32e36f ("usb: cdns3: Add Cadence USB3 DRD Driver")
> > 
> > Signed-off-by: Yongzhi Liu <lyz_cs@xxxxxxxxxx>
> 
> Again, no blank line and use the full width for your text.
> 
> > ---
> >  drivers/usb/cdns3/cdns3-gadget.c | 6 +++++-
> >  1 file changed, 5 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
> > index 5d8c982..7be328e 100644
> > --- a/drivers/usb/cdns3/cdns3-gadget.c
> > +++ b/drivers/usb/cdns3/cdns3-gadget.c
> > @@ -2568,6 +2568,10 @@ static int cdns3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
> >  		struct cdns3_request *priv_req;
> >  
> >  		zlp_request = cdns3_gadget_ep_alloc_request(ep, GFP_ATOMIC);
> > +		if (!zlp_request) {
> > +			ret = -ENOMEM;
> > +			goto err;
> > +		}
> 
> How did you test this that the if the allocation fails this will clean
> up properly?
> 

I find this by a static analyzer based on frequency and similarity, which report many null ptr deref bugs.
In cdns3/cdns3-gadget.c, I find that we usually check the return value when call function 'cdns3_gadget_ep_alloc_request'.
If 'zcalloc' in 'cdns3_gadget_ep_alloc_request' failed, the allocation will return null. Therefore, i think we should add null checks here.
I will resubmit a new patch if you think the bug is real.
Thanks for your reply and advice.

> thanks,
> 
> greg k-h