iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

usb: gadget: mv_u3d: request_irq() after initializing UDC

Browse Source 
If IRQ occurs between calling  request_irq() and  mv_u3d_eps_init(),
then null pointer dereference occurs since u3d->eps[] wasn't
initialized yet but used in mv_u3d_nuke().

The patch puts registration of the interrupt handler after
initializing of neccesery data.

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: 90fccb529d24 ("usb: gadget: Gadget directory cleanup - group UDC drivers")
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Link: https://lore.kernel.org/r/20210818141247.4794-1-lutovinova@ispras.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Nadezda Lutovinova 2021-08-18 17:12:47 +03:00 committed by Greg Kroah-Hartman
parent 1bc2208355
commit 2af0c5ffad
1 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
drivers/usb/gadget/udc/mv_u3d_core.c
View File

@ -1921,14 +1921,6 @@ static int mv_u3d_probe(struct platform_device *dev)
goto err_get_irq;
}
u3d->irq = r->start;
if (request_irq(u3d->irq, mv_u3d_irq,
IRQF_SHARED, driver_name, u3d)) {
u3d->irq = 0;
dev_err(&dev->dev, "Request irq %d for u3d failed\n",
u3d->irq);
retval = -ENODEV;
goto err_request_irq;
}
/* initialize gadget structure */
u3d->gadget.ops = &mv_u3d_ops; /* usb_gadget_ops */
@ -1941,6 +1933,15 @@ static int mv_u3d_probe(struct platform_device *dev)
mv_u3d_eps_init(u3d);
if (request_irq(u3d->irq, mv_u3d_irq,
IRQF_SHARED, driver_name, u3d)) {
u3d->irq = 0;
dev_err(&dev->dev, "Request irq %d for u3d failed\n",
u3d->irq);
retval = -ENODEV;
goto err_request_irq;
}
/* external vbus detection */
if (u3d->vbus) {
u3d->clock_gating = 1;
@ -1964,8 +1965,8 @@ static int mv_u3d_probe(struct platform_device *dev)
err_unregister:
free_irq(u3d->irq, u3d);
err_request_irq:
err_get_irq:
err_request_irq:
kfree(u3d->status_req);
err_alloc_status_req:
kfree(u3d->eps);