usb: musb: ux500: Fix NULL pointer dereference at system PM

Message ID 1453723289-23157-1-git-send-email-ulf.hansson@linaro.org
State Accepted
Commit 79c5623f1cb85f33403eb9f1e45124e9f56181f8
Headers show

Commit Message

Ulf Hansson Jan. 25, 2016, 12:01 p.m.
The commit 7d32cdef5356 ("usb: musb: fail with error when no DMA
controller set"), caused the core platform driver to correctly return an
error code when fail probing.

Unfurtante it also caused bug for a NULL pointer dereference, during
system suspend for the ux500 driver. The reason is a lacking validation
of the corresponding ->driver_data pointer, which won't be set when the
musb core driver fails to probe (or haven't yet been probed).

Fixes: 7d32cdef5356 ("usb: musb: fail with error when no DMA...")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>

---
 drivers/usb/musb/ux500.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

-- 
1.9.1

Comments

Linus Walleij Jan. 28, 2016, 10:56 a.m. | #1
On Mon, Jan 25, 2016 at 1:01 PM, Ulf Hansson <ulf.hansson@linaro.org> wrote:

> The commit 7d32cdef5356 ("usb: musb: fail with error when no DMA

> controller set"), caused the core platform driver to correctly return an

> error code when fail probing.

>

> Unfurtante it also caused bug for a NULL pointer dereference, during

> system suspend for the ux500 driver. The reason is a lacking validation

> of the corresponding ->driver_data pointer, which won't be set when the

> musb core driver fails to probe (or haven't yet been probed).

>

> Fixes: 7d32cdef5356 ("usb: musb: fail with error when no DMA...")

> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>


Acked-by: Linus Walleij <linus.walleij@linaro.org>


Yours,
Linus Walleij
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c
index b2685e7..3eaa4ba 100644
--- a/drivers/usb/musb/ux500.c
+++ b/drivers/usb/musb/ux500.c
@@ -348,7 +348,9 @@  static int ux500_suspend(struct device *dev)
 	struct ux500_glue	*glue = dev_get_drvdata(dev);
 	struct musb		*musb = glue_to_musb(glue);
 
-	usb_phy_set_suspend(musb->xceiv, 1);
+	if (musb)
+		usb_phy_set_suspend(musb->xceiv, 1);
+
 	clk_disable_unprepare(glue->clk);
 
 	return 0;
@@ -366,7 +368,8 @@  static int ux500_resume(struct device *dev)
 		return ret;
 	}
 
-	usb_phy_set_suspend(musb->xceiv, 0);
+	if (musb)
+		usb_phy_set_suspend(musb->xceiv, 0);
 
 	return 0;
 }