diff options
| author | Jiangong.Han <jiangong.han@windriver.com> | 2026-08-01 17:51:28 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-10 14:43:19 +0200 |
| commit | 0c6cae0f56239e3274b30dbe5b362cd297ccacc7 (patch) | |
| tree | 1a7d82c01fad76f9640f1b1c46b035f354f6c4a0 | |
| parent | d937ca39cc44a01ce64865dd25b1e205a05ae3a0 (diff) | |
| download | linux-next-0c6cae0f56239e3274b30dbe5b362cd297ccacc7.tar.gz linux-next-0c6cae0f56239e3274b30dbe5b362cd297ccacc7.zip | |
USB: usbmon: fix null-ptr-deref in mon_bus_remove() when mon_bus_init() fails
When mon_bus_init() fails to allocate the mon_bus struct, it returns
without setting ubus->mon_bus, so mbus->mon_bus remains NULL.
mon_bus_add() intentionally ignores this failure because the USB core
does not require monitoring to be established for normal operation.
However, when the HCD is later removed, usb_remove_hcd() fires the
USB_BUS_REMOVE notifier which calls mon_bus_remove(), it dereferences
ubus->mon_bus without checking for NULL, causing a null-ptr deference.
Fix this by adding a NULL check for mbus at the top of mon_bus_remove().
If mon_bus_init() failed, ubus->mon_bus is NULL, meaning the bus was
never tracked by the monitor, so there is nothing to clean up and
returning early is correct.
Reported-by: syzbot+5f4b29d9fe710a964482@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5f4b29d9fe710a964482
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jiangong.Han <jiangong.han@windriver.com>
Link: https://patch.msgid.link/20260801095128.46322-1-jiangong.han@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/mon/mon_main.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/usb/mon/mon_main.c b/drivers/usb/mon/mon_main.c index e4fff194fea0..600c9de84c7e 100644 --- a/drivers/usb/mon/mon_main.c +++ b/drivers/usb/mon/mon_main.c @@ -199,6 +199,9 @@ static void mon_bus_remove(struct usb_bus *ubus) { struct mon_bus *mbus = ubus->mon_bus; + if (mbus == NULL) + return; + mutex_lock(&mon_lock); list_del(&mbus->bus_link); if (mbus->text_inited) |