On Thu, Jan 04, 2024 at 06:35:38PM +0530, Udipto Goswami wrote: > Hi Greg, > > On 1/4/2024 4:14 PM, Greg Kroah-Hartman wrote: > > On Thu, Jan 04, 2024 at 03:56:16PM +0530, Udipto Goswami wrote: > > > Currently,the function update_port_device_state gets the usb_hub from > > > udev->parent by calling usb_hub_to_struct_hub. > > > However, in case the actconfig or the maxchild is 0, the usb_hub would > > > be NULL and upon further accessing to get port_dev would result in null > > > pointer dereference. > > > > Is this true for any real (or fake) hardware? > > We saw this in our QCOM hardwares where lvstest.c was calling > get_dev_desc_store: > > usb_set_device_state+0x128/0x17c > create_lvs_device+0x60/0xf8 [lvstest] > get_dev_desc_store+0x94/0x18c [lvstest] > dev_attr_store+0x30/0x48 > > I think the part of the test procedure is to first unbind the hub driver > which calls hub_disconnect setting the maxchild = 0. Are you sure lvstest is correct here? thanks, greg k-h
