From patchwork Tue Nov 4 01:05:42 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoshihiro Shimoda X-Patchwork-Id: 5220641 X-Patchwork-Delegate: geert@linux-m68k.org Return-Path: X-Original-To: patchwork-linux-sh@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 4D4CB9F39B for ; Tue, 4 Nov 2014 01:05:59 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 7E0BE2011E for ; Tue, 4 Nov 2014 01:05:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A083E2011D for ; Tue, 4 Nov 2014 01:05:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751698AbaKDBF5 (ORCPT ); Mon, 3 Nov 2014 20:05:57 -0500 Received: from relmlor2.renesas.com ([210.160.252.172]:51109 "EHLO relmlie1.idc.renesas.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751650AbaKDBF4 (ORCPT ); Mon, 3 Nov 2014 20:05:56 -0500 Received: from unknown (HELO relmlir2.idc.renesas.com) ([10.200.68.152]) by relmlie1.idc.renesas.com with ESMTP; 04 Nov 2014 10:05:54 +0900 Received: from relmlac2.idc.renesas.com (relmlac2.idc.renesas.com [10.200.69.22]) by relmlir2.idc.renesas.com (Postfix) with ESMTP id 89C3B3F75D; Tue, 4 Nov 2014 10:05:54 +0900 (JST) Received: by relmlac2.idc.renesas.com (Postfix, from userid 0) id 8D1AC2806E; Tue, 4 Nov 2014 10:05:54 +0900 (JST) Received: from relmlac2.idc.renesas.com (localhost [127.0.0.1]) by relmlac2.idc.renesas.com (Postfix) with ESMTP id 875CB2806D; Tue, 4 Nov 2014 10:05:54 +0900 (JST) Received: from relmlii2.idc.renesas.com [10.200.68.66] by relmlac2.idc.renesas.com with ESMTP id LAQ25900; Tue, 4 Nov 2014 10:05:54 +0900 X-IronPort-AV: E=Sophos;i="5.07,310,1413212400"; d="scan'208";a="173976934" Received: from mail-sg1lp0087.outbound.protection.outlook.com (HELO APAC01-SG1-obe.outbound.protection.outlook.com) ([207.46.51.87]) by relmlii2.idc.renesas.com with ESMTP/TLS/AES256-SHA; 04 Nov 2014 10:05:53 +0900 Received: from localhost (211.11.155.147) by HKNPR06MB324.apcprd06.prod.outlook.com (10.141.38.18) with Microsoft SMTP Server (TLS) id 15.1.11.14; Tue, 4 Nov 2014 01:05:53 +0000 From: Yoshihiro Shimoda To: , CC: , , Yoshihiro Shimoda , Subject: [PATCH v6 1/4] usb: renesas_usbhs: gadget: fix NULL pointer dereference in ep_disable() Date: Tue, 4 Nov 2014 10:05:42 +0900 Message-ID: <1415063145-4200-2-git-send-email-yoshihiro.shimoda.uh@renesas.com> X-Mailer: git-send-email 1.9.4.msysgit.1 In-Reply-To: <1415063145-4200-1-git-send-email-yoshihiro.shimoda.uh@renesas.com> References: <1415063145-4200-1-git-send-email-yoshihiro.shimoda.uh@renesas.com> MIME-Version: 1.0 X-Originating-IP: [211.11.155.147] X-ClientProxiedBy: HKNPR06CA0035.apcprd06.prod.outlook.com (10.141.16.25) To HKNPR06MB324.apcprd06.prod.outlook.com (10.141.38.18) X-MS-Exchange-Transport-FromEntityHeader: Hosted X-Microsoft-Antispam: UriScan:; X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;SRVR:HKNPR06MB324; X-Exchange-Antispam-Report-Test: UriScan:; X-Forefront-PRVS: 03853D523D X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(6069001)(6009001)(199003)(189002)(76176999)(36756003)(87286001)(78352002)(46102003)(93916002)(50226001)(4396001)(77096003)(19580405001)(229853001)(122386002)(95666004)(104166001)(40100003)(77156002)(107046002)(62966003)(50986999)(19580395003)(106356001)(105586002)(20776003)(66066001)(47776003)(88136002)(89996001)(42382002)(102836001)(64706001)(33646002)(76506005)(87976001)(120916001)(31966008)(48376002)(50466002)(101416001)(99396003)(21056001)(42186005)(97736003)(92566001)(92726001)(88662002); DIR:OUT; SFP:1102; SCL:1; SRVR:HKNPR06MB324; H:localhost; FPR:; MLV:sfv; PTR:InfoNoRecords; A:0; MX:0; LANG:en; X-OriginatorOrg: renesas.com Sender: linux-sh-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-sh@vger.kernel.org X-Spam-Status: No, score=-7.5 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Kazuya Mizuguchi This patch fixes an issue that the NULL pointer dereference happens when we uses g_audio driver. Since the g_audio driver will call usb_ep_disable() in afunc_set_alt() before it calls usb_ep_enable(), the uep->pipe of renesas usbhs driver will be NULL. So, this patch adds a condition to avoid the oops. Signed-off-by: Kazuya Mizuguchi Signed-off-by: Takeshi Kihara Signed-off-by: Yoshihiro Shimoda Fixes: 2f98382dc (usb: renesas_usbhs: Add Renesas USBHS Gadget) Cc: # v3.0+ --- drivers/usb/renesas_usbhs/mod_gadget.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c index 2d17c10..294d43c 100644 --- a/drivers/usb/renesas_usbhs/mod_gadget.c +++ b/drivers/usb/renesas_usbhs/mod_gadget.c @@ -602,6 +602,9 @@ static int usbhsg_ep_disable(struct usb_ep *ep) struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep); struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep); + if (!pipe) + return -EINVAL; + usbhsg_pipe_disable(uep); usbhs_pipe_free(pipe);