[bug report] usb: gadget: f_hid: fix: Move IN request allocation to set_alt()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello Krzysztof Opasiak,

This is a semi-automatic email about new static checker warnings.

The patch 749494b6bdbb: "usb: gadget: f_hid: fix: Move IN request 
allocation to set_alt()" from Jan 24, 2017, leads to the following 
Smatch complaint:

drivers/usb/gadget/function/f_hid.c:382 f_hidg_write()
	 warn: variable dereferenced before check 'hidg->req' (see line 370)

drivers/usb/gadget/function/f_hid.c
   369		spin_unlock_irqrestore(&hidg->write_spinlock, flags);
   370		status = copy_from_user(hidg->req->buf, buffer, count);
                                        ^^^^^^^^^^^^^^
Dereference.

   371	
   372		if (status != 0) {
   373			ERROR(hidg->func.config->cdev,
   374				"copy_from_user error\n");
   375			status = -EINVAL;
   376			goto release_write_pending;
   377		}
   378	
   379		spin_lock_irqsave(&hidg->write_spinlock, flags);
   380	
   381		/* we our function has been disabled by host */
   382		if (!hidg->req) {
                     ^^^^^^^^^
Check too late.

   383			free_ep_req(hidg->in_ep, hidg->req);
                                                 ^^^^^^^^^
This is also a dereference.

   384			/*

regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux