Re: [PATCH] usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe

[Jie Deng]

在 2026/8/7 18:11, Peter Chen 写道:
> On 26-08-06 10:22:58, Jie Deng wrote:
> > The Cadence USBSS controller is a two-function PCI device. The first
> > probed function allocates the driver data and stores it with
> > pci_set_drvdata(), while the second function reuses it via
> > pci_get_drvdata() when pci_is_enabled() reports that the first
> > function has already been probed.
> >
> > When the second function is probed while the first one has been
> > enabled but has not yet set its driver data, pci_get_drvdata()
> > returns NULL, and the subsequent wrap->devfn assignment dereferences
> > a NULL pointer and crashes the kernel.
> > logs:
> > Call trace:
> >    cdns3_pci_probe+0xa4/0x300
> >    local_pci_probe+0x44/0xa8
> >    pci_call_probe+0x54/0x158
> >    pci_device_probe+0x84/0x100
> >    really_probe+0x184/0x3d0
> >    __driver_probe_device+0x80/0x178
> >    driver_probe_device+0x44/0xe8
> >    __driver_attach+0xec/0x1f8
> >    bus_for_each_dev+0x7c/0xe0
> >    driver_attach+0x28/0x38
> >    bus_add_driver+0x110/0x238
> >    driver_register+0x64/0x128
> >    __pci_register_driver+0x50/0x60
> >    cdns3_pci_driver_init+0x28/0x38
> >    do_one_initcall+0x5c/0x280
> >    do_initcalls+0x104/0x1d8
> >    kernel_init_freeable+0x140/0x218
> >    kernel_init+0x28/0x1f8
> >    ret_from_fork+0x10/0x20
> >
> > Return -EPROBE_DEFER in this case so that probing is retried after
> > the first function has completed its probe.
> >
> > Fixes: 8bc1901ca7b0 ("usb:cdns3 Add Cadence USB3 DRD Driver")
> The patch is okay, but the Fixes tag is wrong, 8bc1901ca7b0 was reverted,
> you may use below tag:
>
> Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
>
> After above fix, feel free add:
> Acked-by: Peter Chen <peter.chen@xxxxxxxxxx>
>
> Peter
Thank you for your reply. I will send the V2 version patch later.