lkml.org 
[lkml]   [2021]   [Sep]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 098/144] usb: gadget: mv_u3d: request_irq() after initializing UDC
    Date
    From: Nadezda Lutovinova <lutovinova@ispras.ru>

    [ Upstream commit 2af0c5ffadaf9d13eca28409d4238b4e672942d3 ]

    If IRQ occurs between calling request_irq() and mv_u3d_eps_init(),
    then null pointer dereference occurs since u3d->eps[] wasn't
    initialized yet but used in mv_u3d_nuke().

    The patch puts registration of the interrupt handler after
    initializing of neccesery data.

    Found by Linux Driver Verification project (linuxtesting.org).

    Fixes: 90fccb529d24 ("usb: gadget: Gadget directory cleanup - group UDC drivers")
    Acked-by: Felipe Balbi <balbi@kernel.org>
    Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
    Link: https://lore.kernel.org/r/20210818141247.4794-1-lutovinova@ispras.ru
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/usb/gadget/udc/mv_u3d_core.c | 19 ++++++++++---------
    1 file changed, 10 insertions(+), 9 deletions(-)

    diff --git a/drivers/usb/gadget/udc/mv_u3d_core.c b/drivers/usb/gadget/udc/mv_u3d_core.c
    index 35e02a8d0091..bdba3f48c052 100644
    --- a/drivers/usb/gadget/udc/mv_u3d_core.c
    +++ b/drivers/usb/gadget/udc/mv_u3d_core.c
    @@ -1922,14 +1922,6 @@ static int mv_u3d_probe(struct platform_device *dev)
    goto err_get_irq;
    }
    u3d->irq = r->start;
    - if (request_irq(u3d->irq, mv_u3d_irq,
    - IRQF_SHARED, driver_name, u3d)) {
    - u3d->irq = 0;
    - dev_err(&dev->dev, "Request irq %d for u3d failed\n",
    - u3d->irq);
    - retval = -ENODEV;
    - goto err_request_irq;
    - }

    /* initialize gadget structure */
    u3d->gadget.ops = &mv_u3d_ops; /* usb_gadget_ops */
    @@ -1942,6 +1934,15 @@ static int mv_u3d_probe(struct platform_device *dev)

    mv_u3d_eps_init(u3d);

    + if (request_irq(u3d->irq, mv_u3d_irq,
    + IRQF_SHARED, driver_name, u3d)) {
    + u3d->irq = 0;
    + dev_err(&dev->dev, "Request irq %d for u3d failed\n",
    + u3d->irq);
    + retval = -ENODEV;
    + goto err_request_irq;
    + }
    +
    /* external vbus detection */
    if (u3d->vbus) {
    u3d->clock_gating = 1;
    @@ -1965,8 +1966,8 @@ static int mv_u3d_probe(struct platform_device *dev)

    err_unregister:
    free_irq(u3d->irq, u3d);
    -err_request_irq:
    err_get_irq:
    +err_request_irq:
    kfree(u3d->status_req);
    err_alloc_status_req:
    kfree(u3d->eps);
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-09-13 15:27    [W:3.514 / U:0.284 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site