This patch fixes possibility of dereference by NULLL pointer in "[PATCH 
v5 1/3] usbip: vhci extension: modifications to vhci driver" which has 
been merged to 4.9-rc1. It occurs when a URB with pointer to invalid 
USB/IP device is enqueued in race condition against detach operation.

A pointer was passed to vdev_to_vhci() before NULL check.
In vdev_to_vhci(), there's a dereference by the pointer.

This patch moves vdev_to_vhci() after NULL check of the pointer. 

Signed-off-by: Nobuo Iwata <>
 drivers/usb/usbip/vhci_hcd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 03eccf2..c4724fb 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -460,13 +460,14 @@ static void vhci_tx_urb(struct urb *urb)
        struct vhci_device *vdev = get_vdev(urb->dev);
        struct vhci_priv *priv;
-       struct vhci_hcd *vhci = vdev_to_vhci(vdev);
+       struct vhci_hcd *vhci;
        unsigned long flags;
        if (!vdev) {
                pr_err("could not get virtual device");
+       vhci = vdev_to_vhci(vdev);
        priv = kzalloc(sizeof(struct vhci_priv), GFP_ATOMIC);
        if (!priv) {

To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to
More majordomo info at

Reply via email to