Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 362fd879 authored by Yuanfang Zhang's avatar Yuanfang Zhang
Browse files

coresight: tmc-etr: fix null ptr dereferencing in usb_qdss_close 



"sysfs_buf" will not be free while out_mode switching from mem to usb
and "usbch" will not be assigned in tmc_enable_etr_sink_sysfs, this
will cause passing null ptr to usb_qdss_close when switch out_mode
to mem.

Change-Id: Ibd8b5c78fb55231e34e16a9c32d43c2e771c0f30
Signed-off-by: default avatarYuanfang Zhang <zhangyuanfang@codeaurora.org>
parent a2487ea6

drivers/hwtracing/coresight/coresight-tmc-etr.c

+3 −1
Original line number Diff line number Diff line
@@ -1407,7 +1407,8 @@ static int tmc_enable_etr_sink_sysfs(struct coresight_device *csdev) 
	 */

	spin_lock_irqsave(&drvdata->spinlock, flags);

	sysfs_buf = READ_ONCE(drvdata->sysfs_buf);

	if (!sysfs_buf || (sysfs_buf->size != drvdata->size)) {

	if (!sysfs_buf || (sysfs_buf->size != drvdata->size)

			|| !drvdata->usbch) {

		spin_unlock_irqrestore(&drvdata->spinlock, flags);



		if (drvdata->out_mode == TMC_ETR_OUT_MODE_MEM) {
@@ -1952,6 +1953,7 @@ static int _tmc_disable_etr_sink(struct coresight_device *csdev) 
			spin_unlock_irqrestore(&drvdata->spinlock, flags);

			tmc_etr_bam_disable(drvdata);

			usb_qdss_close(drvdata->usbch);

			drvdata->usbch = NULL;

			drvdata->mode = CS_MODE_DISABLED;

			goto out;

		} else {