usb: gadget: mv_u3d: request_irq() after initializing UDC
If IRQ occurs between calling request_irq() and mv_u3d_eps_init(),
then null pointer dereference occurs since u3d->eps[] wasn't
initialized yet but used in mv_u3d_nuke().
The patch puts registration of the interrupt handler after
initializing of neccesery data.
Found by Linux Driver Verification project (linuxtesting.org).
Fixes: 90fccb529d
("usb: gadget: Gadget directory cleanup - group UDC drivers")
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Link: https://lore.kernel.org/r/20210818141247.4794-1-lutovinova@ispras.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
1bc2208355
commit
2af0c5ffad
|
@ -1921,14 +1921,6 @@ static int mv_u3d_probe(struct platform_device *dev)
|
||||||
goto err_get_irq;
|
goto err_get_irq;
|
||||||
}
|
}
|
||||||
u3d->irq = r->start;
|
u3d->irq = r->start;
|
||||||
if (request_irq(u3d->irq, mv_u3d_irq,
|
|
||||||
IRQF_SHARED, driver_name, u3d)) {
|
|
||||||
u3d->irq = 0;
|
|
||||||
dev_err(&dev->dev, "Request irq %d for u3d failed\n",
|
|
||||||
u3d->irq);
|
|
||||||
retval = -ENODEV;
|
|
||||||
goto err_request_irq;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* initialize gadget structure */
|
/* initialize gadget structure */
|
||||||
u3d->gadget.ops = &mv_u3d_ops; /* usb_gadget_ops */
|
u3d->gadget.ops = &mv_u3d_ops; /* usb_gadget_ops */
|
||||||
|
@ -1941,6 +1933,15 @@ static int mv_u3d_probe(struct platform_device *dev)
|
||||||
|
|
||||||
mv_u3d_eps_init(u3d);
|
mv_u3d_eps_init(u3d);
|
||||||
|
|
||||||
|
if (request_irq(u3d->irq, mv_u3d_irq,
|
||||||
|
IRQF_SHARED, driver_name, u3d)) {
|
||||||
|
u3d->irq = 0;
|
||||||
|
dev_err(&dev->dev, "Request irq %d for u3d failed\n",
|
||||||
|
u3d->irq);
|
||||||
|
retval = -ENODEV;
|
||||||
|
goto err_request_irq;
|
||||||
|
}
|
||||||
|
|
||||||
/* external vbus detection */
|
/* external vbus detection */
|
||||||
if (u3d->vbus) {
|
if (u3d->vbus) {
|
||||||
u3d->clock_gating = 1;
|
u3d->clock_gating = 1;
|
||||||
|
@ -1964,8 +1965,8 @@ static int mv_u3d_probe(struct platform_device *dev)
|
||||||
|
|
||||||
err_unregister:
|
err_unregister:
|
||||||
free_irq(u3d->irq, u3d);
|
free_irq(u3d->irq, u3d);
|
||||||
err_request_irq:
|
|
||||||
err_get_irq:
|
err_get_irq:
|
||||||
|
err_request_irq:
|
||||||
kfree(u3d->status_req);
|
kfree(u3d->status_req);
|
||||||
err_alloc_status_req:
|
err_alloc_status_req:
|
||||||
kfree(u3d->eps);
|
kfree(u3d->eps);
|
||||||
|
|
Loading…
Reference in New Issue