Commit 2af0c5ff authored by Nadezda Lutovinova's avatar Nadezda Lutovinova Committed by Greg Kroah-Hartman
Browse files

usb: gadget: mv_u3d: request_irq() after initializing UDC 



If IRQ occurs between calling  request_irq() and  mv_u3d_eps_init(),
then null pointer dereference occurs since u3d->eps[] wasn't
initialized yet but used in mv_u3d_nuke().

The patch puts registration of the interrupt handler after
initializing of neccesery data.

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: 90fccb52 ("usb: gadget: Gadget directory cleanup - group UDC drivers")
Acked-by: default avatarFelipe Balbi <balbi@kernel.org>
Signed-off-by: default avatarNadezda Lutovinova <lutovinova@ispras.ru>
Link: https://lore.kernel.org/r/20210818141247.4794-1-lutovinova@ispras.ru


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 1bc22083

drivers/usb/gadget/udc/mv_u3d_core.c

+10 −9
Original line number Original line Diff line number Diff line
@@ -1921,14 +1921,6 @@ static int mv_u3d_probe(struct platform_device *dev) 
		goto err_get_irq;

		goto err_get_irq;

	}

	}

	u3d->irq = r->start;

	u3d->irq = r->start;

	if (request_irq(u3d->irq, mv_u3d_irq,

		IRQF_SHARED, driver_name, u3d)) {

		u3d->irq = 0;

		dev_err(&dev->dev, "Request irq %d for u3d failed\n",

			u3d->irq);

		retval = -ENODEV;

		goto err_request_irq;

	}





	/* initialize gadget structure */

	/* initialize gadget structure */

	u3d->gadget.ops = &mv_u3d_ops;	/* usb_gadget_ops */

	u3d->gadget.ops = &mv_u3d_ops;	/* usb_gadget_ops */
@@ -1941,6 +1933,15 @@ static int mv_u3d_probe(struct platform_device *dev) 




	mv_u3d_eps_init(u3d);

	mv_u3d_eps_init(u3d);





	if (request_irq(u3d->irq, mv_u3d_irq,

		IRQF_SHARED, driver_name, u3d)) {

		u3d->irq = 0;

		dev_err(&dev->dev, "Request irq %d for u3d failed\n",

			u3d->irq);

		retval = -ENODEV;

		goto err_request_irq;

	}



	/* external vbus detection */

	/* external vbus detection */

	if (u3d->vbus) {

	if (u3d->vbus) {

		u3d->clock_gating = 1;

		u3d->clock_gating = 1;
@@ -1964,8 +1965,8 @@ static int mv_u3d_probe(struct platform_device *dev) 




err_unregister:

err_unregister:

	free_irq(u3d->irq, u3d);

	free_irq(u3d->irq, u3d);

err_request_irq:

err_get_irq:

err_get_irq:

err_request_irq:

	kfree(u3d->status_req);

	kfree(u3d->status_req);

err_alloc_status_req:

err_alloc_status_req:

	kfree(u3d->eps);

	kfree(u3d->eps);