From patchwork Wed Sep 10 10:33:40 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoshihiro Shimoda X-Patchwork-Id: 4875901 Return-Path: X-Original-To: patchwork-linux-sh@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id D3B5AC0338 for ; Wed, 10 Sep 2014 10:33:55 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 8B5542018E for ; Wed, 10 Sep 2014 10:33:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C80AD200EC for ; Wed, 10 Sep 2014 10:33:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751222AbaIJKdt (ORCPT ); Wed, 10 Sep 2014 06:33:49 -0400 Received: from relmlor2.renesas.com ([210.160.252.172]:50372 "EHLO relmlie1.idc.renesas.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750937AbaIJKds (ORCPT ); Wed, 10 Sep 2014 06:33:48 -0400 Received: from unknown (HELO relmlir2.idc.renesas.com) ([10.200.68.152]) by relmlie1.idc.renesas.com with ESMTP; 10 Sep 2014 19:33:47 +0900 Received: from relmlac1.idc.renesas.com (relmlac1.idc.renesas.com [10.200.69.21]) by relmlir2.idc.renesas.com (Postfix) with ESMTP id 260FF4B1D8; Wed, 10 Sep 2014 19:33:47 +0900 (JST) Received: by relmlac1.idc.renesas.com (Postfix, from userid 0) id 17E228002E; Wed, 10 Sep 2014 19:33:47 +0900 (JST) Received: from relmlac1.idc.renesas.com (localhost [127.0.0.1]) by relmlac1.idc.renesas.com (Postfix) with ESMTP id 10BCC8002D; Wed, 10 Sep 2014 19:33:47 +0900 (JST) Received: from relmlii1.idc.renesas.com [10.200.68.65] by relmlac1.idc.renesas.com with ESMTP id VAA13012; Wed, 10 Sep 2014 19:33:47 +0900 X-IronPort-AV: E=Sophos;i="5.04,497,1406559600"; d="scan'208";a="168720655" Received: from mail-sg1lp0089.outbound.protection.outlook.com (HELO APAC01-SG1-obe.outbound.protection.outlook.com) ([207.46.51.89]) by relmlii1.idc.renesas.com with ESMTP/TLS/AES256-SHA; 10 Sep 2014 19:33:46 +0900 Received: from HKXPR06MB328.apcprd06.prod.outlook.com (10.141.133.18) by HKXPR06MB021.apcprd06.prod.outlook.com (10.242.98.141) with Microsoft SMTP Server (TLS) id 15.0.1024.12; Wed, 10 Sep 2014 10:33:44 +0000 Received: from [10.161.20.147] (211.11.155.147) by HKXPR06MB328.apcprd06.prod.outlook.com (10.141.133.18) with Microsoft SMTP Server (TLS) id 15.0.1024.12; Wed, 10 Sep 2014 10:33:44 +0000 Message-ID: <54102904.6060703@renesas.com> Date: Wed, 10 Sep 2014 19:33:40 +0900 From: Yoshihiro Shimoda User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 MIME-Version: 1.0 To: Greg Kroah-Hartman , Felipe Balbi CC: "linux-usb@vger.kernel.org" , SH-Linux , Kuninori Morimoto , Ulrich Hecht Subject: [PATCH 1/4] usb: renesas_usbhs: gadget: fix NULL pointer dereference in ep_disable() X-Originating-IP: [211.11.155.147] X-ClientProxiedBy: HKNPR04CA011.apcprd04.prod.outlook.com (10.141.16.31) To HKXPR06MB328.apcprd06.prod.outlook.com (10.141.133.18) X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;UriScan:;UriScan:; X-Forefront-PRVS: 033054F29A X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019019)(6049001)(6009001)(189002)(199003)(86362001)(105586002)(50986999)(92566001)(92726001)(106356001)(229853001)(107046002)(46102001)(90102001)(85306004)(117636001)(77096002)(77982001)(99396002)(85852003)(83072002)(97736003)(65816999)(102836001)(76482001)(79102001)(87976001)(87266999)(54356999)(101416001)(50466002)(36756003)(83506001)(81342001)(81542001)(74662001)(74502001)(31966008)(19580405001)(83322001)(19580395003)(95666004)(23756003)(42186005)(66066001)(65956001)(65806001)(21056001)(20776003)(47776003)(80022001)(4396001)(64706001)(62816006); DIR:OUT; SFP:1102; SCL:1; SRVR:HKXPR06MB328; H:[10.161.20.147]; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:; X-OriginatorOrg: renesas.com Sender: linux-sh-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-sh@vger.kernel.org X-Spam-Status: No, score=-9.4 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This patch fixes an issue that the NULL pointer dereference happens when we use g_audio driver. Since the g_audio driver will call usb_ep_disable() in afunc_set_alt() before it calls usb_ep_enable(), the uep->pipe of renesas usbhs driver will be NULL. So, this patch adds a condition to avoid the oops. Signed-off-by: Kazuya Mizuguchi Signed-off-by: Takeshi Kihara Signed-off-by: Yoshihiro Shimoda --- drivers/usb/renesas_usbhs/mod_gadget.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c index 04e6505..a582222 100644 --- a/drivers/usb/renesas_usbhs/mod_gadget.c +++ b/drivers/usb/renesas_usbhs/mod_gadget.c @@ -602,6 +602,9 @@ static int usbhsg_ep_disable(struct usb_ep *ep) struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep); struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep); + if (!uep || !uep->pipe) + return -EINVAL; + usbhsg_pipe_disable(uep); usbhs_pipe_free(pipe);