| From 58945e2c3239dea91dc8da1f25e7480bc8b5fb08 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 15 Jun 2020 14:27:19 +0300 |
| Subject: usb: gadget: udc: Potential Oops in error handling code |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| [ Upstream commit e55f3c37cb8d31c7e301f46396b2ac6a19eb3a7c ] |
| |
| If this is in "transceiver" mode the the ->qwork isn't required and is |
| a NULL pointer. This can lead to a NULL dereference when we call |
| destroy_workqueue(udc->qwork). |
| |
| Fixes: 3517c31a8ece ("usb: gadget: mv_udc: use devm_xxx for probe") |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Felipe Balbi <balbi@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/usb/gadget/udc/mv_udc_core.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c |
| index cafde053788bb..80a1b52c656e0 100644 |
| --- a/drivers/usb/gadget/udc/mv_udc_core.c |
| +++ b/drivers/usb/gadget/udc/mv_udc_core.c |
| @@ -2313,7 +2313,8 @@ static int mv_udc_probe(struct platform_device *pdev) |
| return 0; |
| |
| err_create_workqueue: |
| - destroy_workqueue(udc->qwork); |
| + if (udc->qwork) |
| + destroy_workqueue(udc->qwork); |
| err_destroy_dma: |
| dma_pool_destroy(udc->dtd_pool); |
| err_free_dma: |
| -- |
| 2.25.1 |
| |
