lkml.org 
[lkml]   [2021]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 69/74] usb: gadget: udc: amd5536udc_pci fix null-ptr-dereference
    Date
    From: Tong Zhang <ztong0001@gmail.com>

    commit 72035f4954f0bca2d8c47cf31b3629c42116f5b7 upstream.

    init_dma_pools() calls dma_pool_create(...dev->dev) to create dma pool.
    however, dev->dev is actually set after calling init_dma_pools(), which
    effectively makes dma_pool_create(..NULL) and cause crash.
    To fix this issue, init dma only after dev->dev is set.

    [ 1.317993] RIP: 0010:dma_pool_create+0x83/0x290
    [ 1.323257] Call Trace:
    [ 1.323390] ? pci_write_config_word+0x27/0x30
    [ 1.323626] init_dma_pools+0x41/0x1a0 [snps_udc_core]
    [ 1.323899] udc_pci_probe+0x202/0x2b1 [amd5536udc_pci]

    Fixes: 7c51247a1f62 (usb: gadget: udc: Provide correct arguments for 'dma_pool_create')
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Tong Zhang <ztong0001@gmail.com>
    Link: https://lore.kernel.org/r/20210317230400.357756-1-ztong0001@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/usb/gadget/udc/amd5536udc_pci.c | 10 +++++-----
    1 file changed, 5 insertions(+), 5 deletions(-)

    --- a/drivers/usb/gadget/udc/amd5536udc_pci.c
    +++ b/drivers/usb/gadget/udc/amd5536udc_pci.c
    @@ -154,6 +154,11 @@ static int udc_pci_probe(
    pci_set_master(pdev);
    pci_try_set_mwi(pdev);

    + dev->phys_addr = resource;
    + dev->irq = pdev->irq;
    + dev->pdev = pdev;
    + dev->dev = &pdev->dev;
    +
    /* init dma pools */
    if (use_dma) {
    retval = init_dma_pools(dev);
    @@ -161,11 +166,6 @@ static int udc_pci_probe(
    goto err_dma;
    }

    - dev->phys_addr = resource;
    - dev->irq = pdev->irq;
    - dev->pdev = pdev;
    - dev->dev = &pdev->dev;
    -
    /* general probing */
    if (udc_probe(dev)) {
    retval = -ENODEV;

    \
     
     \ /
      Last update: 2021-04-05 11:08    [W:3.464 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site