| From 38b1927e5bf9bcad4a2e33189ef1c5569f9599ba Mon Sep 17 00:00:00 2001 |
| From: Colin Ian King <colin.king@canonical.com> |
| Date: Thu, 25 Jun 2020 13:44:28 +0100 |
| Subject: [PATCH] phy: sun4i-usb: fix dereference of pointer phy0 before it is |
| null checked |
| |
| commit 38b1927e5bf9bcad4a2e33189ef1c5569f9599ba upstream. |
| |
| Currently pointer phy0 is being dereferenced via the assignment of |
| phy on the call to phy_get_drvdata before phy0 is null checked, this |
| can lead to a null pointer dereference. Fix this by performing the |
| null check on phy0 before the call to phy_get_drvdata. Also replace |
| the phy0 == NULL check with the more usual !phy0 idiom. |
| |
| Addresses-Coverity: ("Dereference before null check") |
| Fixes: e6f32efb1b12 ("phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode") |
| Signed-off-by: Colin Ian King <colin.king@canonical.com> |
| Link: https://lore.kernel.org/r/20200625124428.83564-1-colin.king@canonical.com |
| Signed-off-by: Vinod Koul <vkoul@kernel.org> |
| |
| diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c |
| index 856927382248..e5842e48a5e0 100644 |
| --- a/drivers/phy/allwinner/phy-sun4i-usb.c |
| +++ b/drivers/phy/allwinner/phy-sun4i-usb.c |
| @@ -545,13 +545,14 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work) |
| struct sun4i_usb_phy_data *data = |
| container_of(work, struct sun4i_usb_phy_data, detect.work); |
| struct phy *phy0 = data->phys[0].phy; |
| - struct sun4i_usb_phy *phy = phy_get_drvdata(phy0); |
| + struct sun4i_usb_phy *phy; |
| bool force_session_end, id_notify = false, vbus_notify = false; |
| int id_det, vbus_det; |
| |
| - if (phy0 == NULL) |
| + if (!phy0) |
| return; |
| |
| + phy = phy_get_drvdata(phy0); |
| id_det = sun4i_usb_phy0_get_id_det(data); |
| vbus_det = sun4i_usb_phy0_get_vbus_det(data); |
| |
| -- |
| 2.27.0 |
| |
