diff mbox series

[V2] usb: common: ulpi: Fix crash in ulpi_match()

Message ID 20220117150039.44058-1-jonathanh@nvidia.com
State Superseded
Headers show
Series [V2] usb: common: ulpi: Fix crash in ulpi_match() | expand

Commit Message

Jon Hunter Jan. 17, 2022, 3 p.m. UTC
Commit 7495af930835 ("ARM: multi_v7_defconfig: Enable drivers for
DragonBoard 410c") enables the CONFIG_PHY_QCOM_USB_HS for the ARM
multi_v7_defconfig. Enabling this Kconfig is causing the kernel to crash
on the Tegra20 Ventana platform in the ulpi_match() function.

The Qualcomm USB HS PHY driver that is enabled by CONFIG_PHY_QCOM_USB_HS,
registers a ulpi_driver but this driver does not provide an 'id_table',
so when ulpi_match() is called on the Tegra20 Ventana platform, it
crashes when attempting to deference the id_table pointer which is not
valid. The Qualcomm USB HS PHY driver uses device-tree for matching the
ULPI driver with the device and so fix this crash by using device-tree
for matching if the id_table is not valid.

Fixes: ef6a7bcfb01c ("usb: ulpi: Support device discovery via DT")
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
---
Changes since V1:
- Added fixes tag

 drivers/usb/common/ulpi.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

Comments

Greg Kroah-Hartman Jan. 17, 2022, 3:40 p.m. UTC | #1
On Mon, Jan 17, 2022 at 03:00:39PM +0000, Jon Hunter wrote:
> Commit 7495af930835 ("ARM: multi_v7_defconfig: Enable drivers for
> DragonBoard 410c") enables the CONFIG_PHY_QCOM_USB_HS for the ARM
> multi_v7_defconfig. Enabling this Kconfig is causing the kernel to crash
> on the Tegra20 Ventana platform in the ulpi_match() function.
> 
> The Qualcomm USB HS PHY driver that is enabled by CONFIG_PHY_QCOM_USB_HS,
> registers a ulpi_driver but this driver does not provide an 'id_table',
> so when ulpi_match() is called on the Tegra20 Ventana platform, it
> crashes when attempting to deference the id_table pointer which is not
> valid. The Qualcomm USB HS PHY driver uses device-tree for matching the
> ULPI driver with the device and so fix this crash by using device-tree
> for matching if the id_table is not valid.
> 
> Fixes: ef6a7bcfb01c ("usb: ulpi: Support device discovery via DT")
> Signed-off-by: Jon Hunter <jonathanh@nvidia.com>

No cc: of stable since this is a bug going back to 4.11?

thanks,

greg k-h
Jon Hunter Jan. 18, 2022, 9:02 a.m. UTC | #2
On 17/01/2022 15:40, Greg KH wrote:
> On Mon, Jan 17, 2022 at 03:00:39PM +0000, Jon Hunter wrote:
>> Commit 7495af930835 ("ARM: multi_v7_defconfig: Enable drivers for
>> DragonBoard 410c") enables the CONFIG_PHY_QCOM_USB_HS for the ARM
>> multi_v7_defconfig. Enabling this Kconfig is causing the kernel to crash
>> on the Tegra20 Ventana platform in the ulpi_match() function.
>>
>> The Qualcomm USB HS PHY driver that is enabled by CONFIG_PHY_QCOM_USB_HS,
>> registers a ulpi_driver but this driver does not provide an 'id_table',
>> so when ulpi_match() is called on the Tegra20 Ventana platform, it
>> crashes when attempting to deference the id_table pointer which is not
>> valid. The Qualcomm USB HS PHY driver uses device-tree for matching the
>> ULPI driver with the device and so fix this crash by using device-tree
>> for matching if the id_table is not valid.
>>
>> Fixes: ef6a7bcfb01c ("usb: ulpi: Support device discovery via DT")
>> Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
> 
> No cc: of stable since this is a bug going back to 4.11?


Yes good point.

Heikki, let me know if you want me to resend or if you can add the 
stable tag?

Cheers
Jon
diff mbox series

Patch

diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c
index 4169cf40a03b..8f8405b0d608 100644
--- a/drivers/usb/common/ulpi.c
+++ b/drivers/usb/common/ulpi.c
@@ -39,8 +39,11 @@  static int ulpi_match(struct device *dev, struct device_driver *driver)
 	struct ulpi *ulpi = to_ulpi_dev(dev);
 	const struct ulpi_device_id *id;
 
-	/* Some ULPI devices don't have a vendor id so rely on OF match */
-	if (ulpi->id.vendor == 0)
+	/*
+	 * Some ULPI devices don't have a vendor id
+	 * or provide an id_table so rely on OF match.
+	 */
+	if (ulpi->id.vendor == 0 || !drv->id_table)
 		return of_driver_match_device(dev, driver);
 
 	for (id = drv->id_table; id->vendor; id++)