Messages in this thread |  | | From | Anton Volkov <> | Subject | Possible null pointer dereference in isp1760.ko | Date | Mon, 7 Aug 2017 18:12:38 +0300 |
| |
Hello.
While searching for races in the Linux kernel I've come across "drivers/usb/isp1760/isp1760.ko" module. Here is a question that I came up with while analyzing results. Lines are given using the info from Linux v4.12.
Consider the following case:
Thread 1: Thread 2: isp1760_plat_probe -> isp1760_register -> isp1760_udc_register request_irq(...,udc) -> isp1760_udc_init_eps(udc) isp1760_udc_irq for(i = 0; ...){ for(i = 0; ...) { ep = &udc->ep[i] ep = &udc->ep[i%2] -> isp1760_ep_rx_ready(ep) INIT_LIST_HEAD(ep->queue) list_empty(&ep->queue) (isp1760-udc.c: line 1367) (isp1760-udc.c: line 303)
As far as I understand ep->queue is NULL before its initialization in isp1760_udc_init_eps and list_empty() tries to access the '->next' pointer member of the passed parameter.
Is this case possible from your point of view?
Thank you for your time.
-- Anton Volkov Linux Verification Center, ISPRAS web: http://linuxtesting.org e-mail: avolkov@ispras.ru
|  |