<div dir="ltr"><div>Hi Dmitry,</div><div><br></div><div>Thanks for testing and sending this patch.</div><div>One comment below.</div><div><br></div><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Wed, Apr 9, 2025 at 12:07 AM Dmitry Frolov <<a href="mailto:frolov@swemel.ru">frolov@swemel.ru</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">In function usbredirhost_open_full(), when host->parser==NULL,<br>
the call sequence:<br>
"usbredirhost_close() ---><br>
usbredirhost_clear_device() ---><br>
usbredirhost_handle_disconnect()"<br>
is called, where host->parser is being derefferenced without a check.<br></blockquote><div><br></div><div>Can this really happen ?<br>In usbredirhost_open_full() if host->parser is NULL then host->dev <br>is NULL -- being set only later in the function, with a call to <br>usbredirhost_set_device().<br><br>In usbredirhost_clear_device() if host->dev is NULL the function returns <br>immediately and does not call usbredirhost_handle_disconnect().<br><br>Thanks,<br> Uri.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Found by Linux Verification Center (<a href="http://linuxtesting.org" rel="noreferrer" target="_blank">linuxtesting.org</a>) with SVACE.<br>
<br>
Signed-off-by: Dmitry Frolov <<a href="mailto:frolov@swemel.ru" target="_blank">frolov@swemel.ru</a>><br>
---<br>
usbredirhost/usbredirhost.c | 1 +<br>
1 file changed, 1 insertion(+)<br>
<br>
diff --git a/usbredirhost/usbredirhost.c b/usbredirhost/usbredirhost.c<br>
index 03c56e9..ad4c09b 100644<br>
--- a/usbredirhost/usbredirhost.c<br>
+++ b/usbredirhost/usbredirhost.c<br>
@@ -269,6 +269,7 @@ static int usbredirhost_write(void *priv, uint8_t *data, int count)<br>
packet completion callbacks */<br>
static void usbredirhost_handle_disconnect(struct usbredirhost *host)<br>
{<br>
+ if(!host->parser) return;<br>
/* Disconnect uses its own lock to avoid needing nesting capable locks */<br>
if (host->disconnect_lock) {<br>
host->parser->lock_func(host->disconnect_lock);<br>
-- <br>
2.34.1<br>
<br>
</blockquote></div></div>