Commit 12783c0b authored by Udipto Goswami's avatar Udipto Goswami Committed by Greg Kroah-Hartman
Browse files

usb: core: Prevent null pointer dereference in update_port_device_state 



Currently, the function update_port_device_state gets the usb_hub from
udev->parent by calling usb_hub_to_struct_hub.
However, in case the actconfig or the maxchild is 0, the usb_hub would
be NULL and upon further accessing to get port_dev would result in null
pointer dereference.

Fix this by introducing an if check after the usb_hub is populated.

Fixes: 83cb2604 ("usb: core: add sysfs entry for usb device state")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarUdipto Goswami <quic_ugoswami@quicinc.com>
Reviewed-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20240110095814.7626-1-quic_ugoswami@quicinc.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7c4650de

drivers/usb/core/hub.c

+13 −3
Original line number Diff line number Diff line
@@ -2053,11 +2053,21 @@ static void update_port_device_state(struct usb_device *udev) 


	if (udev->parent) {

		hub = usb_hub_to_struct_hub(udev->parent);



		/*

		 * The Link Layer Validation System Driver (lvstest)

		 * has a test step to unbind the hub before running the

		 * rest of the procedure. This triggers hub_disconnect

		 * which will set the hub's maxchild to 0, further

		 * resulting in usb_hub_to_struct_hub returning NULL.

		 */

		if (hub) {

			port_dev = hub->ports[udev->portnum - 1];

			WRITE_ONCE(port_dev->state, udev->state);

			sysfs_notify_dirent(port_dev->state_kn);

		}

	}

}



static void recursively_mark_NOTATTACHED(struct usb_device *udev)

{