From 3facbaf006007c5efeffd5c28f1a472f330847cc Mon Sep 17 00:00:00 2001 From: xuxinchun1003 Date: Wed, 7 Oct 2026 07:54:47 +0800 Subject: [PATCH] fix: NULL-guard txmsg/txdata drvdata readers (defense in depth) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both reader families do `bus_if = dev_get_drvdata(dev)` and immediately dereference bus_if->bus_priv.usb. With the ordering from the parent commit the corresponding threads (cmd tx, bustx) are quiesced before drvdata is cleared, so these guards should be unreachable in the current call graph — explicit belt-and-suspenders per the #103 reader audit, covering both CONFIG_USB_TX_AGGR txdata variants and txmsg against any future or premature caller. --- drivers/aic8800/aic8800_fdrv/aicwf_usb.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/aic8800/aic8800_fdrv/aicwf_usb.c b/drivers/aic8800/aic8800_fdrv/aicwf_usb.c index 16000d7..04e128a 100644 --- a/drivers/aic8800/aic8800_fdrv/aicwf_usb.c +++ b/drivers/aic8800/aic8800_fdrv/aicwf_usb.c @@ -1409,6 +1409,11 @@ static int aicwf_usb_bus_txmsg(struct device *dev, u8 *buf, u32 len) { int ret = 0; struct aicwf_bus *bus_if = dev_get_drvdata(dev); + /* Defense in depth (review #103): with the parent commit's ordering the + * cmd thread is quiesced before drvdata is cleared, so this should be + * unreachable — guard anyway against a future/premature caller. */ + if (bus_if == NULL) + return -ENODEV; struct aic_usb_dev *usb_dev = bus_if->bus_priv.usb; if (usb_dev->state != USB_UP_ST) @@ -1667,6 +1672,10 @@ static int aicwf_usb_bus_txdata(struct device *dev, struct sk_buff *pkt) uint prio; int ret = -EBADE; struct aicwf_bus *bus_if = dev_get_drvdata(dev); + /* Defense in depth (review #103): usb_bustx_thread is joined before + * drvdata is cleared; guard any other/premature caller. */ + if (bus_if == NULL) + return -ENODEV; struct aic_usb_dev *usbdev = bus_if->bus_priv.usb; //printk("%s\n", __func__); @@ -1703,6 +1712,10 @@ static int aicwf_usb_bus_txdata(struct device *dev, struct sk_buff *skb) int ret = 0; unsigned long flags; struct aicwf_bus *bus_if = dev_get_drvdata(dev); + /* Defense in depth (review #103): usb_bustx_thread is joined before + * drvdata is cleared; guard any other/premature caller. */ + if (bus_if == NULL) + return -ENODEV; struct aic_usb_dev *usb_dev = bus_if->bus_priv.usb; struct rwnx_txhdr *txhdr = (struct rwnx_txhdr *)skb->data; struct rwnx_hw *rwnx_hw = usb_dev->rwnx_hw;