Re: [PATCH] USB: EHCI: fix dereference of ERR_PTR
On Mon, Sep 21, 2015 at 10:48:52AM +0800, Lu, Baolu wrote: > > > On 09/16/2015 10:08 PM, Sudip Mukherjee wrote: > >On error find_tt() returns either a NULL pointer or the error value in > >ERR_PTR. But we were dereferencing it directly without even checking if > >find_tt() returned a valid pointer or not. > > > >Signed-off-by: Sudip Mukherjee > >--- > > drivers/usb/host/ehci-sched.c | 4 > > 1 file changed, 4 insertions(+) > > > >diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c > >index f9a3327..27bced7 100644 > >--- a/drivers/usb/host/ehci-sched.c > >+++ b/drivers/usb/host/ehci-sched.c > >@@ -257,6 +257,8 @@ static void reserve_release_intr_bandwidth(struct > >ehci_hcd *ehci, > > /* FS/LS bus bandwidth */ > > if (tt_usecs) { > > tt = find_tt(qh->ps.udev); > >+if (!tt || IS_ERR(tt)) > > Why not IS_ERR_OR_NULL()? This was v1, corrected in v2. And Alan has already explained why this patch is not required. regards sudip -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH] USB: EHCI: fix dereference of ERR_PTR
On 09/16/2015 10:08 PM, Sudip Mukherjee wrote: On error find_tt() returns either a NULL pointer or the error value in ERR_PTR. But we were dereferencing it directly without even checking if find_tt() returned a valid pointer or not. Signed-off-by: Sudip Mukherjee --- drivers/usb/host/ehci-sched.c | 4 1 file changed, 4 insertions(+) diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c index f9a3327..27bced7 100644 --- a/drivers/usb/host/ehci-sched.c +++ b/drivers/usb/host/ehci-sched.c @@ -257,6 +257,8 @@ static void reserve_release_intr_bandwidth(struct ehci_hcd *ehci, /* FS/LS bus bandwidth */ if (tt_usecs) { tt = find_tt(qh->ps.udev); + if (!tt || IS_ERR(tt)) Why not IS_ERR_OR_NULL()? + return; if (sign > 0) list_add_tail(&qh->ps.ps_list, &tt->ps_list); else @@ -1373,6 +1375,8 @@ static void reserve_release_iso_bandwidth(struct ehci_hcd *ehci, } tt = find_tt(stream->ps.udev); + if (!tt || IS_ERR(tt)) + return; if (sign > 0) list_add_tail(&stream->ps.ps_list, &tt->ps_list); else -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH] USB: EHCI: fix dereference of ERR_PTR
Hello. On 9/16/2015 5:08 PM, Sudip Mukherjee wrote: On error find_tt() returns either a NULL pointer or the error value in ERR_PTR. But we were dereferencing it directly without even checking if find_tt() returned a valid pointer or not. Signed-off-by: Sudip Mukherjee --- drivers/usb/host/ehci-sched.c | 4 1 file changed, 4 insertions(+) diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c index f9a3327..27bced7 100644 --- a/drivers/usb/host/ehci-sched.c +++ b/drivers/usb/host/ehci-sched.c @@ -257,6 +257,8 @@ static void reserve_release_intr_bandwidth(struct ehci_hcd *ehci, /* FS/LS bus bandwidth */ if (tt_usecs) { tt = find_tt(qh->ps.udev); + if (!tt || IS_ERR(tt)) There's IS_ERR_OR_NULL()? + return; if (sign > 0) list_add_tail(&qh->ps.ps_list, &tt->ps_list); else @@ -1373,6 +1375,8 @@ static void reserve_release_iso_bandwidth(struct ehci_hcd *ehci, } tt = find_tt(stream->ps.udev); + if (!tt || IS_ERR(tt)) Likewise. [...] MBR, Sergei -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH] USB: EHCI: fix dereference of ERR_PTR
On Wed, Sep 16, 2015 at 11:08 AM, Sudip Mukherjee wrote: > On error find_tt() returns either a NULL pointer or the error value in > ERR_PTR. But we were dereferencing it directly without even checking if > find_tt() returned a valid pointer or not. > > Signed-off-by: Sudip Mukherjee > --- > drivers/usb/host/ehci-sched.c | 4 > 1 file changed, 4 insertions(+) > > diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c > index f9a3327..27bced7 100644 > --- a/drivers/usb/host/ehci-sched.c > +++ b/drivers/usb/host/ehci-sched.c > @@ -257,6 +257,8 @@ static void reserve_release_intr_bandwidth(struct > ehci_hcd *ehci, > /* FS/LS bus bandwidth */ > if (tt_usecs) { > tt = find_tt(qh->ps.udev); > + if (!tt || IS_ERR(tt)) > + return; Could you use IS_ERR_OR_NULL(tt)? -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH] USB: EHCI: fix dereference of ERR_PTR
On error find_tt() returns either a NULL pointer or the error value in ERR_PTR. But we were dereferencing it directly without even checking if find_tt() returned a valid pointer or not. Signed-off-by: Sudip Mukherjee --- drivers/usb/host/ehci-sched.c | 4 1 file changed, 4 insertions(+) diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c index f9a3327..27bced7 100644 --- a/drivers/usb/host/ehci-sched.c +++ b/drivers/usb/host/ehci-sched.c @@ -257,6 +257,8 @@ static void reserve_release_intr_bandwidth(struct ehci_hcd *ehci, /* FS/LS bus bandwidth */ if (tt_usecs) { tt = find_tt(qh->ps.udev); + if (!tt || IS_ERR(tt)) + return; if (sign > 0) list_add_tail(&qh->ps.ps_list, &tt->ps_list); else @@ -1373,6 +1375,8 @@ static void reserve_release_iso_bandwidth(struct ehci_hcd *ehci, } tt = find_tt(stream->ps.udev); + if (!tt || IS_ERR(tt)) + return; if (sign > 0) list_add_tail(&stream->ps.ps_list, &tt->ps_list); else -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/