Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9877e6d9 authored by Hemant Kumar's avatar Hemant Kumar
Browse files

usb: dwc3: core: Fix error handling bugs in driver probe 



If dwc3_core_get_phy() fails control going to err0 label
which calls destroy_workqueue() without allocating workqueue.
This results into NULL pointer dereference. If
alloc_ordered_workqueue() fails driver returns error and exits
probe, instead of restoring res->start. Fix these issues by
adding new label err1 to call destroy_workqueue() above err0
label and update goto labels accordingly.

Change-Id: I709d5b9a3b639a00733ef61d3c377cc3d2c83f7f
Signed-off-by: default avatarHemant Kumar <hemantk@codeaurora.org>
parent d91ef6f6

drivers/usb/dwc3/core.c

+4 −3
Original line number Diff line number Diff line
@@ -1243,7 +1243,7 @@ static int dwc3_probe(struct platform_device *pdev) 
	dwc->dwc_wq = alloc_ordered_workqueue("dwc_wq", WQ_HIGHPRI);

	if (!dwc->dwc_wq) {

		pr_err("%s: Unable to create workqueue dwc_wq\n", __func__);

		return -ENOMEM;

		goto err0;

	}



	INIT_WORK(&dwc->bh_work, dwc3_bh_work);
@@ -1290,7 +1290,7 @@ static int dwc3_probe(struct platform_device *pdev) 


	ret = dwc3_core_init_mode(dwc);

	if (ret)

		goto err0;

		goto err1;



	ret = dwc3_debugfs_init(dwc);

	if (ret) {
@@ -1312,6 +1312,8 @@ static int dwc3_probe(struct platform_device *pdev) 


err_core_init:

	dwc3_core_exit_mode(dwc);

err1:

	destroy_workqueue(dwc->dwc_wq);

err0:

	/*

	 * restore res->start back to its original value so that, in case the
@@ -1319,7 +1321,6 @@ static int dwc3_probe(struct platform_device *pdev) 
	 * memory region the next time probe is called.

	 */

	res->start -= DWC3_GLOBALS_REGS_START;

	destroy_workqueue(dwc->dwc_wq);



	return ret;

}