On Fri, Jan 03, 2020 at 04:12:07PM +0000, Sean Young wrote:
On Fri, Jan 03, 2020 at 04:02:42PM +0100, Johan Hovold wrote:
On Sun, Dec 29, 2019 at 06:22:39PM +0100, Greg Kroah-Hartman wrote:
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 649cd16c438f51d4cd777e71ca1f47f6e0c5e65d ]
If usb_set_interface() failed, iface->cur_altsetting will not be assigned and it will be used in flexcop_usb_transfer_init() It may lead a NULL pointer dereference.
Check usb_set_interface() return value in flexcop_usb_init() and return failed to avoid using this NULL pointer.
Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: Sean Young sean@mess.org Signed-off-by: Mauro Carvalho Chehab mchehab+samsung@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org
This commit is bogus and should be dropped from all stable queues.
Contrary to what the commit message claims, iface->cur_altsetting will never be NULL so there's no risk for a NULL-pointer dereference here.
Yes, you are right, I can't find any path through which cur_altsetting will be set to NULL. The commit message is wrong. I am sorry for letting this slip through.
Thank you for pointing this out.
Even though the change itself is benign, we shouldn't spread this confusion further.
usb_set_interface() can fail for a number of reasons, and we should not continue if it fails. So, the commit message is misleading but the change itself is still valid.
Sure, the change itself is fine, but I wouldn't consider it stable material even with a correct commit message as it is not a critical fix.
And the user would still see an error message in case changing altsetting fails.
Johan