From patchwork Thu Nov 12 05:45:28 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoshihiro Shimoda X-Patchwork-Id: 7599421 X-Patchwork-Delegate: geert@linux-m68k.org Return-Path: X-Original-To: patchwork-linux-sh@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 8E8BDBF90C for ; Thu, 12 Nov 2015 05:45:51 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id A945220498 for ; Thu, 12 Nov 2015 05:45:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9EC682045B for ; Thu, 12 Nov 2015 05:45:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752271AbbKLFps (ORCPT ); Thu, 12 Nov 2015 00:45:48 -0500 Received: from relmlor4.renesas.com ([210.160.252.174]:13325 "EHLO relmlie3.idc.renesas.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752217AbbKLFpq (ORCPT ); Thu, 12 Nov 2015 00:45:46 -0500 Received: from unknown (HELO relmlir1.idc.renesas.com) ([10.200.68.151]) by relmlie3.idc.renesas.com with ESMTP; 12 Nov 2015 14:45:44 +0900 Received: from relmlac1.idc.renesas.com (relmlac1.idc.renesas.com [10.200.69.21]) by relmlir1.idc.renesas.com (Postfix) with ESMTP id B43414F1C4; Thu, 12 Nov 2015 14:45:44 +0900 (JST) Received: by relmlac1.idc.renesas.com (Postfix, from userid 0) id 6A1FC8002D; Thu, 12 Nov 2015 14:45:44 +0900 (JST) Received: from relmlac1.idc.renesas.com (localhost [127.0.0.1]) by relmlac1.idc.renesas.com (Postfix) with ESMTP id 304D88002F; Thu, 12 Nov 2015 14:45:44 +0900 (JST) Received: from relmlii2.idc.renesas.com [10.200.68.66] by relmlac1.idc.renesas.com with ESMTP id QAB02983; Thu, 12 Nov 2015 14:45:44 +0900 X-IronPort-AV: E=Sophos;i="5.20,280,1444662000"; d="scan'";a="199580332" Received: from mail-hk2apc01lp0214.outbound.protection.outlook.com (HELO APC01-HK2-obe.outbound.protection.outlook.com) ([65.55.88.214]) by relmlii2.idc.renesas.com with ESMTP/TLS/AES256-SHA; 12 Nov 2015 14:45:43 +0900 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=<>; Received: from localhost (211.11.155.145) by SG2PR06MB0920.apcprd06.prod.outlook.com (10.162.204.153) with Microsoft SMTP Server (TLS) id 15.1.318.15; Thu, 12 Nov 2015 05:45:42 +0000 From: Yoshihiro Shimoda To: , CC: , , Yoshihiro Shimoda Subject: [PATCH 1/3] usb: renesas_usbhs: gadget: Fix NULL pointer dereference in usbhsg_ep_dequeue() Date: Thu, 12 Nov 2015 14:45:28 +0900 Message-ID: <1447307130-6072-2-git-send-email-yoshihiro.shimoda.uh@renesas.com> X-Mailer: git-send-email 1.9.4.msysgit.1 In-Reply-To: <1447307130-6072-1-git-send-email-yoshihiro.shimoda.uh@renesas.com> References: <1447307130-6072-1-git-send-email-yoshihiro.shimoda.uh@renesas.com> MIME-Version: 1.0 X-Originating-IP: [211.11.155.145] X-ClientProxiedBy: KAWPR01CA0024.jpnprd01.prod.outlook.com (25.161.24.34) To SG2PR06MB0920.apcprd06.prod.outlook.com (25.162.204.153) X-Microsoft-Exchange-Diagnostics: 1; SG2PR06MB0920; 2:K54ci3Xklr4Focisi3ZlmVWjRAo1qLU/RXw/68TlG32Z8+Y9FakbyIfQjFfu0NcvOL6i0vPo6XexwZAZz+7kdU0fsGoZaNmOj++OMtnTMLnLslof9HDSgpTiO/aiYOzoS+PPP9vXyTsqcnMtZEuB6orHW+2MD2CMY594p6mhqsc=; 3:nI57thzBJQsdTU5HPxR4x18ZzBoi0pnOlu4RL5GQtr/Xcvki17WvO/QkDKTrpnfThkmJ0JDCOAaivGeK3HlfJqxFCDJakjsm4UgEpQTMNBM3bDkVQDX0rTGpvBfF/y6iO84MSSa5bMhoJPLlFrsr4Q==; 25:wePxYCZuvvvF5NhiCvd+XOv1xlWvjbzmaQe2Pw/j7eKtrfksGpBbHU5ui/nAYD63vHy0xkU9EqTKomU9XyZtoCSnd2euO6by0gSZSINN0fE8ODu5/Txx/cNCS+t9yjBaIg84Z+J5ShAt3GDsamXEPMFQHxWQUgmOVPerUK2dN6/RXrF2NUyOPYgbx4gC0jcFTFA0vNW0Jwd+ybAN9io4PfmgWquZGvSd4yi2fwP4cApr0Y5SMl9eoEtV/R03i5G+52Pvkr/jVt8zPZMIY7l1Ag== X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:SG2PR06MB0920; X-Microsoft-Exchange-Diagnostics: 1; SG2PR06MB0920; 20:UT9wOwuqTvxLCJSNTtg7sBNGf2s+8WoMEYfbG6FUDB09T5J0VQAeyRN0echJQaw7htjHW9OkZ81wh7aGByhh7spioMF4qArK/rG8jdiYLuK/q/UGMyn1d8A13Bz4oI99UeZkIIImtr+kqvNwxusBZ5emdmec3RQwVWIwBAZT/pfoVB+jXn1rS1UrQ87t2vi/FDNpIntq7kKbENKN7Qy6HqiVUueu+t82pOhsZsNIhPlxRsG3UhHNVBcMA/+PozdCBOwtw8SPe2gZXzc7CpKbSg81hHYMmOLK2qR6c4NFgwfqzpWs1BFOteEEJwFHGBjtciOLEaa1999iV0vt5KnlI4qLZse2Y0NfCSblV8NCWW+fTpai+z/EQ/cMvGYzPnuC5BCCQak8E0INMTcIkV7Yr3yOiDUShwReOpsFmnhwSfBkT2cKhKdU73GHP8ON4nU7nP9+Adk3od9E1FCYZPn9/xge3oWo4YzvR2b+YV04RzP/iHVV/9sx+VWjXz/52cwQ; 4:cPzoqHd3Ym2FJBiKXpFHy7D3dXK3/JuH5pJjBMtHY9LvWpXQTloEcMjxjSdlk4iEkgw4mR1517PJS1fUAv76kEzi4O6FkxcwXcjGuult/L4cs9+BevumradAENR/P7fMKscuh8EPalS34xob7dvsHEMHactm4ccyJoC6IeWt+0AV+GGmqV0eaRbcPMlVDhdC4/9nYO0Bx4UzYWb79CQtr3jOr4zoxgmwab0YBSjJTpAtP23Hk1bARyh/7NRJ71cG8yISv7xjFtYHuOhi8dFtvuGnDmsZH0P3+meWNXJUeRHcdPsalLZFWB+ltqepBefX43dqy75OnXD6nB9f3vSYKRgiaoxadHITpjHCCd0CpyzqjDEf+3KUJKiTtO7QZN/g X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(85106069007906); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(601004)(2401047)(520078)(8121501046)(5005006)(3002001)(10201501046); SRVR:SG2PR06MB0920; BCL:0; PCL:0; RULEID:; SRVR:SG2PR06MB0920; X-Forefront-PRVS: 07584EDBCD X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(6069001)(6009001)(199003)(189002)(4001430100002)(42186005)(92566002)(50226001)(40100003)(76506005)(78352002)(122386002)(87976001)(5007970100001)(50986999)(5003940100001)(5001770100001)(19580395003)(19580405001)(106356001)(101416001)(97736004)(5001920100001)(50466002)(2950100001)(5004730100002)(42382002)(5001960100002)(81156007)(48376002)(107886002)(36756003)(229853001)(47776003)(189998001)(66066001)(33646002)(77096005)(5008740100001)(105586002)(76176999); DIR:OUT; SFP:1102; SCL:1; SRVR:SG2PR06MB0920; H:localhost; FPR:; SPF:None; PTR:InfoNoRecords; A:0; MX:0; LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; SG2PR06MB0920; 23:BQP6dEj4XKCYRGZUgkDKczoOKIRh4fP7loaN8LJ58?= =?us-ascii?Q?5Xm8eLCeEZYT34IwYcJ7fXGNBsfOgeI461I7bpTvS2e7wTVHQZdCPGxNc+qH?= =?us-ascii?Q?zN3TgdguTahJqRKfd5ULGUSnPE0jT9zDLVakC3ebqnvr1wtQ5ytkiQ76sT+/?= =?us-ascii?Q?L3TZx1IxjLKaX1Tb0Pho8xxX2Odk0GbBUCUrg0mG62sLSi08vbRWB21sxQGi?= =?us-ascii?Q?m6qty9zJq4BYUgVBu3ONPLgualbMpdJOIJ1GyeiAavCKfEeQNTZzvOzQ0yks?= =?us-ascii?Q?zJf0G34vsLusBoq8L6nk9voROjHZ+hOhO/po+19Gu8Nlkxr/4L4kllxENxLd?= =?us-ascii?Q?q5B4hZSi7FDH43NeNtDur3D2d8YYj8gOPZwzMpG1oEm15zarL288RGMem0VP?= =?us-ascii?Q?XCFqvOPgVLwGiTYyI016ZIYrABWhh4ZCZ85u4bDxso9LA312mekUoHqYZU9f?= =?us-ascii?Q?hpG4SLmxiNf6bjqAMbjXTB+asc0JcQEaMKxqPQ4Vrzf5GJlSRr/R4XYnMjrn?= =?us-ascii?Q?8AQxT7hHcpEhIbeD6EtvuPU9JJxKJU/CXvBW/3jf2SzyLGfl9drtHq9Mm799?= =?us-ascii?Q?/297k+HBrvTlRw0cXlm1ZK4c98Z3ZtTZVptzkOgZHib9F/3AOUOKua8YU+ex?= =?us-ascii?Q?far5GtUM8JAR7CPgPuRxzsMeNJFUIhy5uTDMNkCZKq4b80QkUFOadI9jZGyh?= =?us-ascii?Q?0JEF+MdqaLNtVm56XvWi6raw+3o8wpVovu4qdB9CVYgsWpWqX8EoaX+IQHq0?= =?us-ascii?Q?EAG8+vQ4Ao9/MKtj/ukUUHU/BkrtAJkqQeWMMU9Ef2Qfmdba8ramVI9ZXX2o?= =?us-ascii?Q?dHP4k2qEsUyZ1XO0pZ45gFl+iIbXdkvyCOzx2vO8GA9NuJKB/cRKYF1hIi88?= =?us-ascii?Q?kUdca8TH6feCV9MtahFzDTV6bZzvC2O9kfOmpqRCFRAuQ/gwskUCO7CeQhff?= =?us-ascii?Q?dbbPKZnvyzgg2mCSCZHq1cRU5BUJwNIhznreD4IlAF/fhO/ZlB1wUU7YBTom?= =?us-ascii?Q?QC5WCabts7YGnmLo92omfblmWXvhCWhDW4a81ur4gXRjlZ9/mZx6VhM5gwqo?= =?us-ascii?Q?/N5ASvXcRaMuDZsJrFXPqsgvT7mJkrAHmFimbr7owfv8QH4Yakd1Fbqt5/Cc?= =?us-ascii?Q?ncIGDa+txePJ7j5b4PVBX7nI01u/3TP?= X-Microsoft-Exchange-Diagnostics: 1; SG2PR06MB0920; 5:p2bWTInIqBirwUtR4MmfKYjU1scxYHHD0NeBfCr/fWKssy+r64dn9c/AXFeUPrwDwP/hPVGrkqlIZr0/gmVYwomHnjJCuG5jxa+MNfnATNrlefursuDOV3W8fF7RXBPKg1tuJxXY6UkbAxgikB3LmA==; 24:t5WUnace1vrgCr93dpESGLnGqph7mgAsRo4o9Rokey+FusEaizzR9jInR5uzGR+sK3Ni7h2M1Mxn458/t7PqyQN6LVHSYjCFfz2tlYGkt6Q=; 20:HnCUcxopAZviyFwAD3VYTC1s3Sm/4V/W3rNm1lkeNLhdIF/HrZUmO0nn6+mOHB/0Hs51/HXxofbtOuadqcymCvEg4tEFU0TeOPV+8aCilTRS4DX/XasjZ8AI7wrS1w4EsmYT4/g4kPGMI3+ja+AYhVF2N4UeeeOST2s7MATpjSw= SpamDiagnosticOutput: 1:23 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: renesas.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Nov 2015 05:45:42.0234 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2PR06MB0920 Sender: linux-sh-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-sh@vger.kernel.org X-Spam-Status: No, score=-4.0 required=5.0 tests=AXB_X_OUTLOOKPROT_ENVSDR, BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This patch fixes an issue that NULL pointer dereference happens when a gadget driver calls usb_ep_dequeue() after usb_ep_disable(). Signed-off-by: Yoshihiro Shimoda --- drivers/usb/renesas_usbhs/mod_gadget.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c index de4f97d..8f7a78e 100644 --- a/drivers/usb/renesas_usbhs/mod_gadget.c +++ b/drivers/usb/renesas_usbhs/mod_gadget.c @@ -131,7 +131,8 @@ static void __usbhsg_queue_pop(struct usbhsg_uep *uep, struct device *dev = usbhsg_gpriv_to_dev(gpriv); struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv); - dev_dbg(dev, "pipe %d : queue pop\n", usbhs_pipe_number(pipe)); + if (pipe) + dev_dbg(dev, "pipe %d : queue pop\n", usbhs_pipe_number(pipe)); ureq->req.status = status; spin_unlock(usbhs_priv_to_lock(priv)); @@ -685,7 +686,13 @@ static int usbhsg_ep_dequeue(struct usb_ep *ep, struct usb_request *req) struct usbhsg_request *ureq = usbhsg_req_to_ureq(req); struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep); - usbhs_pkt_pop(pipe, usbhsg_ureq_to_pkt(ureq)); + if (pipe) + usbhs_pkt_pop(pipe, usbhsg_ureq_to_pkt(ureq)); + + /* + * To dequeue a request, this driver should call the usbhsg_queue_pop() + * even if the pipe is NULL. + */ usbhsg_queue_pop(uep, ureq, -ECONNRESET); return 0;