Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 21c82201 authored by Nadezda Lutovinova's avatar Nadezda Lutovinova Committed by Greg Kroah-Hartman
Browse files

usb: gadget: mv_u3d: request_irq() after initializing UDC 



[ Upstream commit 2af0c5ffadaf9d13eca28409d4238b4e672942d3 ]

If IRQ occurs between calling  request_irq() and  mv_u3d_eps_init(),
then null pointer dereference occurs since u3d->eps[] wasn't
initialized yet but used in mv_u3d_nuke().

The patch puts registration of the interrupt handler after
initializing of neccesery data.

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: 90fccb52 ("usb: gadget: Gadget directory cleanup - group UDC drivers")
Acked-by: default avatarFelipe Balbi <balbi@kernel.org>
Signed-off-by: default avatarNadezda Lutovinova <lutovinova@ispras.ru>
Link: https://lore.kernel.org/r/20210818141247.4794-1-lutovinova@ispras.ru


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent dce4b005

drivers/usb/gadget/udc/mv_u3d_core.c

+10 −9
Original line number Diff line number Diff line
@@ -1922,14 +1922,6 @@ static int mv_u3d_probe(struct platform_device *dev) 
		goto err_get_irq;

	}

	u3d->irq = r->start;

	if (request_irq(u3d->irq, mv_u3d_irq,

		IRQF_SHARED, driver_name, u3d)) {

		u3d->irq = 0;

		dev_err(&dev->dev, "Request irq %d for u3d failed\n",

			u3d->irq);

		retval = -ENODEV;

		goto err_request_irq;

	}



	/* initialize gadget structure */

	u3d->gadget.ops = &mv_u3d_ops;	/* usb_gadget_ops */
@@ -1942,6 +1934,15 @@ static int mv_u3d_probe(struct platform_device *dev) 


	mv_u3d_eps_init(u3d);



	if (request_irq(u3d->irq, mv_u3d_irq,

		IRQF_SHARED, driver_name, u3d)) {

		u3d->irq = 0;

		dev_err(&dev->dev, "Request irq %d for u3d failed\n",

			u3d->irq);

		retval = -ENODEV;

		goto err_request_irq;

	}



	/* external vbus detection */

	if (u3d->vbus) {

		u3d->clock_gating = 1;
@@ -1965,8 +1966,8 @@ static int mv_u3d_probe(struct platform_device *dev) 


err_unregister:

	free_irq(u3d->irq, u3d);

err_request_irq:

err_get_irq:

err_request_irq:

	kfree(u3d->status_req);

err_alloc_status_req:

	kfree(u3d->eps);