leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
2b12978928
linux/drivers/usb/gadget/function
History
Pawel Szewczyk a25a23cc85 usb: gadget: f_midi: fix segfault when reading empty id 
When midi function is created, 'id' attribute is initialized with
SNDRV_DEFAULT_STR1, which is NULL pointer. Trying to read this attribute
before filling it ends up with segmentation fault.

This commit fix this issue by preventing null pointer dereference. Now
f_midi_opts_id_show() returns empty string when id is a null pointer.

Reproduction path:

$ mkdir functions/midi.0
$ cat functions/midi.0/id

[   53.130132] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
[   53.132630] pgd = ec6cc000
[   53.135308] [00000000] *pgd=6b759831, *pte=00000000, *ppte=00000000
[   53.141530] Internal error: Oops: 17 [#1] PREEMPT SMP ARM
[   53.146904] Modules linked in: usb_f_midi snd_rawmidi libcomposite
[   53.153071] CPU: 1 PID: 2936 Comm: cat Not tainted
3.19.0-00041-gcf4b216 #7
[   53.160010] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[   53.166088] task: ee234c80 ti: ec764000 task.ti: ec764000
[   53.171482] PC is at strlcpy+0x8/0x60
[   53.175128] LR is at f_midi_opts_id_show+0x28/0x3c [usb_f_midi]
[   53.181019] pc : [<c0222a9c>]    lr : [<bf01bed0>]    psr: 60000053
[   53.181019] sp : ec765ef8  ip : 00000141  fp : 00000000
[   53.192474] r10: 00019000  r9 : ed7546c0  r8 : 00010000
[   53.197682] r7 : ec765f80  r6 : eb46a000  r5 : eb46a000  r4 :
ed754734
[   53.204192] r3 : ee234c80  r2 : 00001000  r1 : 00000000  r0 :
eb46a000
[   53.210704] Flags: nZCv  IRQs on  FIQs off  Mode SVC_32  ISA ARM
Segment user
[   53.217907] Control: 10c5387d  Table: 6c6cc04a  DAC: 00000015
[   53.223636] Process cat (pid: 2936, stack limit = 0xec764238)
[   53.229364] Stack: (0xec765ef8 to 0xec766000)
[   53.233706] 5ee0:
ed754734 ed7546c0
[   53.241866] 5f00: eb46a000 bf01bed0 eb753b80 bf01cc44 eb753b98
bf01b0a4 bf01b08c c0125dd0
[   53.250025] 5f20: 00002f19 00000000 ec432e00 bf01cce8 c0530c00
00019000 00010000 ec765f80
[   53.258184] 5f40: 00010000 ec764000 00019000 c00cc4ac ec432e00
c00cc55c 00000017 000081a4
[   53.266343] 5f60: 00000001 00000000 00000000 ec432e00 ec432e00
00010000 00019000 c00cc620
[   53.274502] 5f80: 00000000 00000000 00000000 00010000 ffff1000
00019000 00000003 c000e9a8
[   53.282662] 5fa0: 00000000 c000e7e0 00010000 ffff1000 00000003
00019000 00010000 00019000
[   53.290821] 5fc0: 00010000 ffff1000 00019000 00000003 7fffe000
00000001 00000000 00000000
[   53.298980] 5fe0: 00000000 be8c68d4 0000b995 b6f0e3e6 40000070
00000003 00000000 00000000
[   53.307157] [<c0222a9c>] (strlcpy) from [<bf01bed0>]
(f_midi_opts_id_show+0x28/0x3c [usb_f_midi])
[   53.316006] [<bf01bed0>] (f_midi_opts_id_show [usb_f_midi]) from
[<bf01b0a4>] (f_midi_opts_attr_show+0x18/0x24 )
[   53.327209] [<bf01b0a4>] (f_midi_opts_attr_show [usb_f_midi]) from
[<c0125dd0>] (configfs_read_file+0x9c/0xec)
[   53.337180] [<c0125dd0>] (configfs_read_file) from [<c00cc4ac>]
(__vfs_read+0x18/0x4c)
[   53.345073] [<c00cc4ac>] (__vfs_read) from [<c00cc55c>]
(vfs_read+0x7c/0x100)
[   53.352190] [<c00cc55c>] (vfs_read) from [<c00cc620>]
(SyS_read+0x40/0x8c)
[   53.359056] [<c00cc620>] (SyS_read) from [<c000e7e0>]
(ret_fast_syscall+0x0/0x34)
[   53.366513] Code: ebffe3d3 e8bd8008 e92d4070 e1a05000 (e5d14000)
[   53.372641] ---[ end trace e4f53a4e233d98d0 ]---

Signed-off-by: Pawel Szewczyk <p.szewczyk@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-05-14 14:04:57 -05:00
..
f_acm.c usb: gadget: function: acm: make f_acm pass USB20CV Chapter9 2014-10-20 15:58:48 -05:00
f_ecm.c
f_eem.c usb: gadget: function: Remove redundant usb_free_all_descriptors 2014-10-23 13:57:24 -05:00
f_fs.c make new_sync_{read,write}() static 2015-04-11 22:29:40 -04:00
f_hid.c usb: gadget: hid: Fix static variable usage 2015-04-27 14:44:23 -05:00
f_loopback.c Revert "usb: gadget: zero: Add support for interrupt EP" 2015-03-11 10:00:05 -05:00
f_mass_storage.c usb: patches for v4.1 merge window 2015-03-24 22:57:49 +01:00
f_mass_storage.h
f_midi.c usb: gadget: f_midi: fix segfault when reading empty id 2015-05-14 14:04:57 -05:00
f_ncm.c usb: gadget: function: Added usb_assign_descriptors failure check 2014-11-03 10:01:24 -06:00
f_obex.c usb: gadget: function: Remove redundant usb_free_all_descriptors 2014-10-23 13:57:24 -05:00
f_phonet.c usb: gadget: function: phonet: balance usb_ep_disable calls 2015-02-23 00:18:52 -06:00
f_printer.c usb: gadget: f_printer: use non-zero flag for bitwise and 2015-03-13 10:41:05 -05:00
f_rndis.c usb: gadget: function: delete an unnecessary check before rndis_add_hdr() 2014-11-21 09:08:12 -06:00
f_serial.c usb: gadget: serial: replace {V,}DBG macro with dev_{v,}dbg 2014-08-27 14:13:17 -05:00
f_sourcesink.c Revert "usb: gadget: zero: Add support for interrupt EP" 2015-03-11 10:00:05 -05:00
f_subset.c usb: gadget: function: Remove redundant usb_free_all_descriptors 2014-10-23 13:57:24 -05:00
f_uac1.c Linux 3.19-rc5 2015-01-19 09:57:20 -06:00
f_uac2.c usb: gadget: function: f_uac2: fix sparse warnings 2015-02-23 09:21:28 -06:00
f_uvc.c [media] gadget/uvc: embed video_device 2015-04-02 23:36:20 -03:00
f_uvc.h usb: gadget: f_uvc: remove compatibility layer 2014-09-09 09:49:41 -05:00
g_zero.h Revert "usb: gadget: zero: Add support for interrupt EP" 2015-03-11 10:00:05 -05:00
Makefile usb: gadget: f_printer: convert to new function interface with backward compatibility 2015-03-10 15:33:40 -05:00
ndis.h
rndis.c
rndis.h
storage_common.c
storage_common.h
u_ecm.h
u_eem.h
u_ether_configfs.h
u_ether.c usb: gadget: ethernet: re-use %pM specifier to print MAC 2015-01-19 12:53:32 -06:00
u_ether.h
u_fs.h usb: gadget: ffs: add eventfd notification about ffs events 2015-01-27 09:34:59 -06:00
u_gether.h
u_hid.h usb: gadget: hid: add configfs support 2014-11-06 16:18:19 -06:00
u_midi.h usb: gadget: f_midi: add configfs support 2014-11-05 13:37:17 -06:00
u_ncm.h
u_phonet.h
u_printer.h usb: gadget: printer: add configfs support 2015-03-10 15:33:41 -05:00
u_rndis.h
u_serial.c usb: gadget: serial: fix re-ordering of tx data 2015-04-27 14:44:29 -05:00
u_serial.h
u_uac1.c usb: gadget: u_uac1: fix one code style problem 2015-01-15 09:41:48 -06:00
u_uac1.h usb: gadget: uac1: struct gaudio is useless for struct f_uac1_opts 2015-01-15 09:41:48 -06:00
u_uac2.h usb: gadget: f_uac2: add configfs support 2014-08-20 14:04:42 -05:00
u_uvc.h usb: gadget: uvc: configfs support in uvc function 2015-01-12 12:13:26 -06:00
uvc_configfs.c usb: gadget: uvc: comments for iterating over streaming hierarchy 2015-01-27 10:00:27 -06:00
uvc_configfs.h usb: gadget: uvc: configfs support in uvc function 2015-01-12 12:13:26 -06:00
uvc_queue.c [media] uvc gadget: switch to v4l2 core locking 2015-03-02 17:05:23 -03:00
uvc_queue.h [media] uvc gadget: switch to v4l2 core locking 2015-03-02 17:05:23 -03:00
uvc_v4l2.c Merge branch 'drm-next-merged' of git://people.freedesktop.org/~airlied/linux into v4l_for_linus 2015-04-21 09:44:55 -03:00
uvc_v4l2.h usb: gadget: uvc: separately compile some components of f_uvc 2014-09-09 09:49:12 -05:00
uvc_video.c Merge branch 'drm-next-merged' of git://people.freedesktop.org/~airlied/linux into v4l_for_linus 2015-04-21 09:44:55 -03:00
uvc_video.h usb: gadget: uvc: separately compile some components of f_uvc 2014-09-09 09:49:12 -05:00
uvc.h [media] gadget/uvc: embed video_device 2015-04-02 23:36:20 -03:00