Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5a8141bd authored by Rajendra Nayak's avatar Rajendra Nayak Committed by Felipe Balbi
Browse files

usb: phy: phy-msm-usb: Fix usage of devm_regulator_bulk_get() 



The regulator_bulk_data pointer passed to devm_regulator_bulk_get()
is used to store the client handles for the regulators, which
is later used by devm_regulator_bulk_release() to free the
regulators.
Passing a local array as is done here means the memory used to
store the handles is freed causing the handles to be corrupted,
resulting in a crash when devm_regulator_bulk_release() tries to
free them.

Fix this my moving the array inside of the msm_otg structure.

Signed-off-by: default avatarRajendra Nayak <rnayak@codeaurora.org>
Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
parent aca5b9eb

drivers/usb/phy/phy-msm-usb.c

+9 −8
Original line number Diff line number Diff line
@@ -197,6 +197,7 @@ struct msm_otg { 
	struct regulator *v3p3;

	struct regulator *v1p8;

	struct regulator *vddcx;

	struct regulator_bulk_data supplies[3];



	struct reset_control *phy_rst;

	struct reset_control *link_rst;
@@ -1731,7 +1732,6 @@ static int msm_otg_reboot_notify(struct notifier_block *this, 


static int msm_otg_probe(struct platform_device *pdev)

{

	struct regulator_bulk_data regs[3];

	int ret = 0;

	struct device_node *np = pdev->dev.of_node;

	struct msm_otg_platform_data *pdata;
@@ -1817,17 +1817,18 @@ static int msm_otg_probe(struct platform_device *pdev) 
		return motg->irq;

	}



	regs[0].supply = "vddcx";

	regs[1].supply = "v3p3";

	regs[2].supply = "v1p8";

	motg->supplies[0].supply = "vddcx";

	motg->supplies[1].supply = "v3p3";

	motg->supplies[2].supply = "v1p8";



	ret = devm_regulator_bulk_get(motg->phy.dev, ARRAY_SIZE(regs), regs);

	ret = devm_regulator_bulk_get(motg->phy.dev, ARRAY_SIZE(motg->supplies),

				      motg->supplies);

	if (ret)

		return ret;



	motg->vddcx = regs[0].consumer;

	motg->v3p3  = regs[1].consumer;

	motg->v1p8  = regs[2].consumer;

	motg->vddcx = motg->supplies[0].consumer;

	motg->v3p3  = motg->supplies[1].consumer;

	motg->v1p8  = motg->supplies[2].consumer;



	clk_set_rate(motg->clk, 60000000);