lkml.org 
[lkml]   [2020]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.7 159/265] usb: gadget: udc: Potential Oops in error handling code
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit e55f3c37cb8d31c7e301f46396b2ac6a19eb3a7c ]

    If this is in "transceiver" mode the the ->qwork isn't required and is
    a NULL pointer. This can lead to a NULL dereference when we call
    destroy_workqueue(udc->qwork).

    Fixes: 3517c31a8ece ("usb: gadget: mv_udc: use devm_xxx for probe")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Felipe Balbi <balbi@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/usb/gadget/udc/mv_udc_core.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c
    index cafde053788bb..80a1b52c656e0 100644
    --- a/drivers/usb/gadget/udc/mv_udc_core.c
    +++ b/drivers/usb/gadget/udc/mv_udc_core.c
    @@ -2313,7 +2313,8 @@ static int mv_udc_probe(struct platform_device *pdev)
    return 0;

    err_create_workqueue:
    - destroy_workqueue(udc->qwork);
    + if (udc->qwork)
    + destroy_workqueue(udc->qwork);
    err_destroy_dma:
    dma_pool_destroy(udc->dtd_pool);
    err_free_dma:
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-06-30 00:03    [W:4.110 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site