Add a NULL check for the return value of calloc() in
usbip_exported_device_new(). If calloc() fails and returns NULL,
the subsequent dereference of edev->sudev would cause a NULL
pointer dereference.

Also fix the error path at the 'err' label to check edev before
dereferencing edev->sudev. Without this fix, if calloc() fails and
jumps to 'err', the code would dereference NULL when checking
edev->sudev.

Signed-off-by: longlong yan <yanlonglong@kylinos.cn>
---
 tools/usb/usbip/libsrc/usbip_host_common.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/usb/usbip/libsrc/usbip_host_common.c b/tools/usb/usbip/libsrc/usbip_host_common.c
index 01599cb2fa7b..94762bc282eb 100644
--- a/tools/usb/usbip/libsrc/usbip_host_common.c
+++ b/tools/usb/usbip/libsrc/usbip_host_common.c
@@ -71,6 +71,8 @@ struct usbip_exported_device *usbip_exported_device_new(
 	int i;
 
 	edev = calloc(1, sizeof(struct usbip_exported_device));
+	if (!edev)
+		goto err;
 
 	edev->sudev =
 		udev_device_new_from_syspath(udev_context, sdevpath);
@@ -107,7 +109,7 @@ struct usbip_exported_device *usbip_exported_device_new(
 
 	return edev;
 err:
-	if (edev->sudev)
+	if (edev && edev->sudev)
 		udev_device_unref(edev->sudev);
 	if (edev)
 		free(edev);
-- 
2.43.0

On 8/17/26 00:06, longlong yan wrote:
> Add a NULL check for the return value of calloc() in
> usbip_exported_device_new(). If calloc() fails and returns NULL,
> the subsequent dereference of edev->sudev would cause a NULL
> pointer dereference.
> 
> Also fix the error path at the 'err' label to check edev before
> dereferencing edev->sudev. Without this fix, if calloc() fails and
> jumps to 'err', the code would dereference NULL when checking
> edev->sudev.
> 

It is theoretically possible for calloc() to fail, however how often
does it fail and were you able to make this allocation to fail?

If not, how did you test this patch? In any case, I am not going to
take this patch and all the other patches you sent adding checks to
calloc() calls in other places in usbip tool.

> Signed-off-by: longlong yan <yanlonglong@kylinos.cn>
> ---
>   tools/usb/usbip/libsrc/usbip_host_common.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/usb/usbip/libsrc/usbip_host_common.c b/tools/usb/usbip/libsrc/usbip_host_common.c
> index 01599cb2fa7b..94762bc282eb 100644
> --- a/tools/usb/usbip/libsrc/usbip_host_common.c
> +++ b/tools/usb/usbip/libsrc/usbip_host_common.c
> @@ -71,6 +71,8 @@ struct usbip_exported_device *usbip_exported_device_new(
>   	int i;
>   
>   	edev = calloc(1, sizeof(struct usbip_exported_device));
> +	if (!edev)
> +		goto err;
>   
>   	edev->sudev =
>   		udev_device_new_from_syspath(udev_context, sdevpath);
> @@ -107,7 +109,7 @@ struct usbip_exported_device *usbip_exported_device_new(
>   
>   	return edev;
>   err:
> -	if (edev->sudev)
> +	if (edev && edev->sudev)
>   		udev_device_unref(edev->sudev);
>   	if (edev)
>   		free(edev);

thanks,
-- Shuah