Re: [PATCH] usb: gadget: rndis: Avoid dereference before NULL check

[Greg KH]

On Fri, Sep 09, 2022 at 01:56:15AM +0800, Jim Lin wrote:
> NULL check is performed after params->dev is dereferenced in
> dev_get_stats.

I do not understand this statement.

> Fixed by adding a NULL check before dereferencing params->dev and
> removing subsequent NULL checks for it.
> 
> Signed-off-by: Aniruddha TVS Rao <anrao@xxxxxxxxxx>
> Signed-off-by: Jim Lin <jilin@xxxxxxxxxx>
> ---
>  drivers/usb/gadget/function/rndis.c | 37 ++++++++++++-----------------
>  1 file changed, 15 insertions(+), 22 deletions(-)
> 
> diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c
> index 64de9f1b874c..d2f18f34c8e5 100644
> --- a/drivers/usb/gadget/function/rndis.c
> +++ b/drivers/usb/gadget/function/rndis.c
> @@ -198,6 +198,9 @@ static int gen_ndis_query_resp(struct rndis_params *params, u32 OID, u8 *buf,
>  	outbuf = (__le32 *)&resp[1];
>  	resp->InformationBufferOffset = cpu_to_le32(16);
>  
> +	if (!params->dev)
> +		return -ENODEV;
> +

As Sergey points out, this check is useless and the ones below should
also be removed.

But, why make this check at all, how did you trigger a problem with the
current code?

Are you using this driver?  If so, why?  It is totally broken (as per
the specification) and we really really need to just delete it from the
tree to prevent anyone else from ever using it.

thanks,

greg k-h