[PATCH] nfc: nfcmrvl: fix null pointer dereference in nfcmrvl_bulk_complete

[Joshua Crofts]

A race condition in the current implementation can cause a null pointer
dereference. When nfcmrvl_nci_register_dev() calls nci_register_device(),
the NCI device is immediately exposed to userspace. If userspace brings
up the device before probe() finishes assigning drv_data->priv,
submitted bulk URBs can complete while priv is still NULL.

Additionally, nfcmrvl_bulk_complete() incorrectly checked
NFCMRVL_NCI_RUNNING on drv_data->flags instead of drv_data->priv->flags.

Fix this by adding a NULL check and testing NFCMRVL_NCI_RUNNING on
drv_data->priv->flags before processing the completed URB.

Fixes: f26e30cc6b50 ("NFC: nfcmrvl: Initial commit for Marvell NFC driver")
Reported-by: syzbot+59d5e6a8ed04e6a000c8@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=59d5e6a8ed04e6a000c8
Tested-by: syzbot+59d5e6a8ed04e6a000c8@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Joshua Crofts <joshua.crofts1@xxxxxxxxx>
---
 drivers/nfc/nfcmrvl/usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c
index c7f2afe00b93..c22d783718fe 100644
--- a/drivers/nfc/nfcmrvl/usb.c
+++ b/drivers/nfc/nfcmrvl/usb.c
@@ -61,7 +61,7 @@ static void nfcmrvl_bulk_complete(struct urb *urb)
 	dev_dbg(&drv_data->udev->dev, "urb %p status %d count %d\n",
 		urb, urb->status, urb->actual_length);
 
-	if (!test_bit(NFCMRVL_NCI_RUNNING, &drv_data->flags))
+	if (!drv_data->priv || !test_bit(NFCMRVL_NCI_RUNNING, &drv_data->priv->flags))
 		return;
 
 	if (!urb->status) {
-- 
2.47.3