Bug 9594

Reply-To: akpm@linux-foundation.org

On Mon, 17 Dec 2007 22:16:23 -0800 (PST) bugme-daemon@bugzilla.kernel.org wrote:

> http://bugzilla.kernel.org/show_bug.cgi?id=9594
> 
>            Summary: Dereferencing NULL pointer on drivers/usb/gadget/ether.c
>            Product: Drivers
>            Version: 2.5
>      KernelVersion: 2.6.23
>           Platform: All
>         OS/Version: Linux
>               Tree: Mainline
>             Status: NEW
>           Severity: normal
>           Priority: P1
>          Component: USB
>         AssignedTo: greg@kroah.com
>         ReportedBy: marciobuss@gmail.com
> 
> 
> The potential error can be tracked down as follows:
> 
> (1) line 1050: let the second conjunct on the "if" statment be false
>     meaning "dev->status_ep" is null. This means the "if" evaluates to false.
> 
> follow thru the code until...
> 
> (2) line 1101: usb_ep_disable(dev->status_ep) passes in a null argument, 
>     however "use_ep_disable" cannot handle that:
> 
>    static inline int
>    usb_ep_disable (struct usb_ep *ep)
>    {
>         return ep->ops->disable (ep);
>    }
> 
> 
> -- 
> Configure bugmail: http://bugzilla.kernel.org/userprefs.cgi?tab=email
> ------- You are receiving this mail because: -------
> You are on the CC list for the bug, or are watching someone who is.

Reply-To: david-b@pacbell.net

> > http://bugzilla.kernel.org/show_bug.cgi?id=9594
> > 
> >     ...
> > 
> > The potential error can be tracked down as follows:
> > 
> > (1) line 1050: let the second conjunct on the "if" statment be false
> >     meaning "dev->status_ep" is null. This means the "if" evaluates to
> false.

I'm guessing this is really line 1020 at the top of set_ether_config(),
in the current kernel.  Because line 1050 has nothing to do with status_ep.

> > follow thru the code until...
> > 
> > (2) line 1101: usb_ep_disable(dev->status_ep) passes in a null argument, 
> >     however "use_ep_disable" cannot handle that:

And I'm assuming that's 51 lines later, the "on error..." path.
As we know, no errors happen hence all error paths work Just Fine.  ;)

Another way to put this diagnosis is that the same test needs to
be used in both places, else it's overkill in one of them.

Created attachment 14127 [details]
probable fix

I'm assuming this is another bug noted by code inspection rather than real usage, so testing is impossible ... please clarify.