From patchwork Tue Mar 8 05:58:00 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoshihiro Shimoda X-Patchwork-Id: 8529771 X-Patchwork-Delegate: geert@linux-m68k.org Return-Path: X-Original-To: patchwork-linux-renesas-soc@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id AD9249F8A8 for ; Tue, 8 Mar 2016 05:58:30 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 16F0E20148 for ; Tue, 8 Mar 2016 05:58:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4D02C201C0 for ; Tue, 8 Mar 2016 05:58:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754033AbcCHF6Z (ORCPT ); Tue, 8 Mar 2016 00:58:25 -0500 Received: from relmlor1.renesas.com ([210.160.252.171]:35064 "EHLO relmlie4.idc.renesas.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753990AbcCHF6O (ORCPT ); Tue, 8 Mar 2016 00:58:14 -0500 Received: from unknown (HELO relmlir4.idc.renesas.com) ([10.200.68.154]) by relmlie4.idc.renesas.com with ESMTP; 08 Mar 2016 14:58:13 +0900 Received: from relmlac2.idc.renesas.com (relmlac2.idc.renesas.com [10.200.69.22]) by relmlir4.idc.renesas.com (Postfix) with ESMTP id 1F1DF4B560; Tue, 8 Mar 2016 14:58:13 +0900 (JST) Received: by relmlac2.idc.renesas.com (Postfix, from userid 0) id 002722806E; Tue, 8 Mar 2016 14:58:12 +0900 (JST) Received: from relmlac2.idc.renesas.com (localhost [127.0.0.1]) by relmlac2.idc.renesas.com (Postfix) with ESMTP id EA7C82806D; Tue, 8 Mar 2016 14:58:12 +0900 (JST) Received: from relmlii2.idc.renesas.com [10.200.68.66] by relmlac2.idc.renesas.com with ESMTP id QAD06954; Tue, 8 Mar 2016 14:58:12 +0900 X-IronPort-AV: E=Sophos;i="5.22,555,1449500400"; d="scan'";a="207192027" Received: from mail-hk2apc01lp0210.outbound.protection.outlook.com (HELO APC01-HK2-obe.outbound.protection.outlook.com) ([65.55.88.210]) by relmlii2.idc.renesas.com with ESMTP/TLS/AES256-SHA; 08 Mar 2016 14:58:12 +0900 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=renesasgroup.onmicrosoft.com; s=selector1-renesasgroup-onmicrosoft-com; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=lCLiQ+m65XTnRZkReupjKN6J2Js4yScaGYJ60JaPME4=; b=F+r1MbPfTIcgOR34hakvOa4H9LQ/WtKh+giHXLSx7/4/EjQseT6HMKDCggxhloj37hXd7pw/3WSOOHXErSkxj6/lzoKu0EwEvPPICUyzXtBXP6L3VcBqF9jWnj6plBgxooVKO9Y0v7WJ8z4UQIfKd4Illf2B8lN4R5xfpqMhGmY= Authentication-Results: kernel.org; dkim=none (message not signed) header.d=none; kernel.org; dmarc=none action=none header.from=renesas.com; Received: from localhost (211.11.155.144) by SG2PR06MB0919.apcprd06.prod.outlook.com (10.162.204.152) with Microsoft SMTP Server (TLS) id 15.1.415.20; Tue, 8 Mar 2016 05:58:10 +0000 From: Yoshihiro Shimoda To: CC: , , , Yoshihiro Shimoda Subject: [PATCH 1/2] usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler() Date: Tue, 8 Mar 2016 14:58:00 +0900 Message-ID: <1457416681-7516-2-git-send-email-yoshihiro.shimoda.uh@renesas.com> X-Mailer: git-send-email 1.9.4.msysgit.1 In-Reply-To: <1457416681-7516-1-git-send-email-yoshihiro.shimoda.uh@renesas.com> References: <1457416681-7516-1-git-send-email-yoshihiro.shimoda.uh@renesas.com> MIME-Version: 1.0 X-Originating-IP: [211.11.155.144] X-ClientProxiedBy: TY1PR01CA0031.jpnprd01.prod.outlook.com (25.164.162.141) To SG2PR06MB0919.apcprd06.prod.outlook.com (25.162.204.152) X-Microsoft-Exchange-Diagnostics: 1; SG2PR06MB0919; 2:fIfQM8ToBBHmZl0sDzsTlPTddbW8PP/Ofo/QAXnDCGqFoxgqLphyJsFcNqqakQWz8rv149NlK6Bzg9NOKnTt+WvbNEVZ4ep7QU5BDoz4dRoSVsjWIxwtbHm0pshtDXxLpluQXzl+slS3ExpGw/dQ4Q==; 3:TwhHyA0sLVahmvHFOcJvbySyJN0gkaOtFbUuVP6Fti2EWcKDoIS/oCmDCgUnrGYo7EUowQ8e2KZTZGMsDLfXlumsVsIJD/+o1NUgNPjgQqeqD2GTL9FeicSLG7ALfrdy; 25:9fM3Q93aZ3JZjbFti61vUzbO805vR2rDJGRoOIeHgphnex+g+bDk70d7Ksd1Whe5jTLqzF8jusmEAc2IyVvvyhsI/hEuxDqiB8cxgb+Kc16dEqJ9SUCoHrRJT8bZ62ST8kgbgT12dxLQrTL1ojLqnduLD8qpxmtyVgmCgPUBtF2DJ6awtTZsfqzHcf1DKwab0v7iETdLJ6MC/Om5BIlkZPcVXG7aAr2WeMICZ+JikHMf2urxNoqW2tLZcMUEk/clhVUCah7yOK22Xp2CW0o9QMoTi8JOeSxdsrqjC1Ax9aboUgcV/D4qE0jehIayE28jVID7XnO1kS5DOXf8Wa1lLb9JYVPHhxBXNZVKV8rfe60= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:SG2PR06MB0919; X-MS-Office365-Filtering-Correlation-Id: cefcbabc-12a1-42ff-19dd-08d34716a172 X-Microsoft-Exchange-Diagnostics: 1; SG2PR06MB0919; 20:qpGRuaN1pqQgb330I6No29oinSRt0k1etNB0FFvTnBTN9LTViJfvJ/L3MVAQTHW2++vZvW5A/n5m4TPOSTqf17dcExhQhwlzzZBjodI5IWizNNgg7E55rHGo+9ETLUXfUmiCXEZMcYHrh6hSZ5ZBsUL459JSlqWfIIi+fncoLbnwhcCno2n9OmJiJRMq027Kuq/6njOYLlYwcxXDv0zFMYPMucUm+6sascba0vmm537BagK3hrQ1ZD59BrBG3NolvSdefYHqB8qVIc6aFFAodzZwy6uEGFBtGga9wteJEIarL/tPwDd+tPHGvZjoZZ3cXoBP1IopggQ1cyu5GBqaJI6i9v7BLFSa1tUN30wh/wim6ZUXhwcjx92th4vLPipcm3jpL4nOWcsc9ukczSjilD9TXFprHo/GOrRk/zdFunTAuJOMWWwA7ItydOE4j+seVBdBntDBxqjp6rDmz11bLAMmA54zkeSUsjmCVGOPivHtkDgchIilUxclEdG99Vh8; 4:X/2pqJF2+xpKjPmYHatdczR2jlBBEyAHWCOk/7Lww24XgC0MIq34L9MUQODekPyp2AJaD/dK9Nb7bkc0y8winxsZJ+vGU2IQWUwdKtcbJIWSbrKfUiQL5PVMU7VqLAuoCCa28sVIKEiYRAgoXKwq9mVtZtsj2jlIUdZv3i+iwVu041chZ6VjEWZfzQTz7M82kv/MBHa5loneOQUXZnYkGnX8zr/IuqK98ON96/HKuzgyTQuZgoWSEGbAnUCPuZ8WZMGxShAVD8qiQ42Jv/6UvX5QcyOw+UxaNY+BNsIyBL4BXKRfZhEyhj28vU7rOWDapnT9WvUE6XtKrnHtFbadNg/xngIKSIAy9PEy7l8+q/6fPaWLMmKP0P0JW7es1xZn X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046); SRVR:SG2PR06MB0919; BCL:0; PCL:0; RULEID:; SRVR:SG2PR06MB0919; X-Forefront-PRVS: 08756AC3C8 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(4630300001)(6009001)(6069001)(5003940100001)(87976001)(107886002)(189998001)(42186005)(2906002)(81166005)(5004730100002)(4326007)(50466002)(229853001)(2351001)(40100003)(5008740100001)(1096002)(36756003)(19580405001)(19580395003)(76176999)(6116002)(4001430100002)(586003)(122386002)(3846002)(48376002)(110136002)(47776003)(92566002)(2950100001)(77096005)(76506005)(66066001)(33646002)(50226001)(50986999); DIR:OUT; SFP:1102; SCL:1; SRVR:SG2PR06MB0919; H:localhost; FPR:; SPF:None; MLV:sfv; LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; SG2PR06MB0919; 23:UjgwZwk76YzRkqBTlOZ4XJcB7TcxeH2SU1XXYvTLQ?= =?us-ascii?Q?frVR1kg8SVRxTbdtoJOGQm5FESR15m+Wy6mwTP2fgMkPGMRO43ECCT6EnxPj?= =?us-ascii?Q?6jtZ1eciQamuY/U93NSThG5/MOy/HCcXzzWaFEYHLyTj9Zbz11Mn8V0jnwWr?= =?us-ascii?Q?gBV21HmA5A+QBDXfdpgIA6mR3ujD/6g5Yf/UcItwKvKvshrYycm1tKJr7wnm?= =?us-ascii?Q?G9PC/twvISla46t2yhffujtoc3Q9wSxQCtAvdyO+iZXSJFc0YWbZtZNHE3zu?= =?us-ascii?Q?RbTcyPd33M6gJj1XdykFBgAvA/E6EHQQsQYYByV4PXPUaT6+mEXTecdt2BoN?= =?us-ascii?Q?TVk5Pr2u9CmcFno52McUyTz7A5EMOub57Eb1/lz3af234d8BKPzZ339U1j5c?= =?us-ascii?Q?zHf1VXYfNiEKe+GP7LIAQcsTbVD9RP4g5WHJax4p5rc4kZ2ePwZoCIW/myXY?= =?us-ascii?Q?Q0atuLDDuh6i6iaiKl8X6aUld9NO4TuI0VVLxma3rqtH4ws3VOa2gfNUhanZ?= =?us-ascii?Q?C7retF9OLXkr/WjOXwH5qFDZikENoaSOMWEKw8BkS7H2Bv6N9+dlosDL9MsY?= =?us-ascii?Q?USIrOK2ibenigJJ7yoq4yReH6QlAHQhRuv99mBpcSzy1QY5/kqadBbznk0Gk?= =?us-ascii?Q?nia+uEWgHcfYB9oYlxPECNphxYxAHY5P9G82qFh37zNa/i68P2W7ra6puoSj?= =?us-ascii?Q?WvQx8QIS2v2p54y8JqIVQHqveyLy6kMCc55qZzsXwJXivL9NOatjh1uUJYIk?= =?us-ascii?Q?ZE9b9B9uBCxHnzWUfmvxDJKDdpByNJqMuB5b6UotDIfK3PoJXHHQhKZai3d8?= =?us-ascii?Q?lJ5fIxr27HA4s4K3faJeaq8Mt5daPy3DlYteaQfxSuZFDiPPX/fJfmQvm/YI?= =?us-ascii?Q?hQ+sw62/J2WAJuV2GuD36LpUs1Z3i1aXxSbk+ut6woP7NSbItje/ghJIhKcB?= =?us-ascii?Q?hB7CmNKutZUozvxlSzpOIpQXg6rg9zHmGRV1MOJsrY/JRF0gzS2bDqNJaoHV?= =?us-ascii?Q?MzdONUjhyXLH9aMH1b0AaggUDh95iAbe8DOEwjInT5DDA=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1; SG2PR06MB0919; 5:j9oMnjXZ571XMCF49I7aVJsSCMKPqLBSFX5/Jm6dCQeyQqK4sNOMzbMiyqcFh8P7odOOjGz2uzIPoyEf+ee2N8fvajYSt8mw3GtbnIrTrFZWTdgSv4BsiFDMlvaisDcw6lCFRx8h+sDwbQIjQBCYfQ==; 24:qvJrlN3k4ITsXX4FY+P3G7KrKE0GR5vOOIJqIV3n42CpChJcVHUW4Vn6Hyrg0GdTbRh8HQxkO9us26KbgyyxJj9/USKR4XGcviO3+m021sA=; 20:e/aQH+PMiXFESJ9hWB5Hm1h9dsHtaBXmfSVeNfZEDxPmT40R/zFbieaN67A5BzZ2zgGHH41Tj1GCNCqbrCqbb+PBv8JRWot/tXwvUy7mj7R9DX3nebA48qUuyt5NfyDm6bOub1df6tsyUlKdb5PgTBqbOltA6kFzVjvNL0Mm9NI= SpamDiagnosticOutput: 1:23 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: renesas.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Mar 2016 05:58:10.9865 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2PR06MB0919 Sender: linux-renesas-soc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-renesas-soc@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI,RP_MATCHES_RCVD,UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When unexpected situation happened (e.g. tx/rx irq happened while DMAC is used), the usbhsf_pkt_handler() was possible to cause NULL pointer dereference like the followings: Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = c0004000 [00000000] *pgd=00000000 Internal error: Oops: 80000007 [#1] SMP ARM Modules linked in: usb_f_acm u_serial g_serial libcomposite CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.5.0-rc6-00842-gac57066-dirty #63 Hardware name: Generic R8A7790 (Flattened Device Tree) task: c0729c00 ti: c0724000 task.ti: c0724000 PC is at 0x0 LR is at usbhsf_pkt_handler+0xac/0x118 pc : [<00000000>] lr : [] psr: 60000193 sp : c0725db8 ip : 00000000 fp : c0725df4 r10: 00000001 r9 : 00000193 r8 : ef3ccab4 r7 : ef3cca10 r6 : eea4586c r5 : 00000000 r4 : ef19ceb4 r3 : 00000000 r2 : 0000009c r1 : c0725dc4 r0 : ef19ceb4 This patch adds a condition to avoid the dereference. Signed-off-by: Yoshihiro Shimoda --- drivers/usb/renesas_usbhs/fifo.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c index b4de70e..0c25c01 100644 --- a/drivers/usb/renesas_usbhs/fifo.c +++ b/drivers/usb/renesas_usbhs/fifo.c @@ -190,7 +190,8 @@ static int usbhsf_pkt_handler(struct usbhs_pipe *pipe, int type) goto __usbhs_pkt_handler_end; } - ret = func(pkt, &is_done); + if (likely(func)) + ret = func(pkt, &is_done); if (is_done) __usbhsf_pkt_del(pkt);