| Message ID | 20211117074923.GF5237@kili (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | d4d2e5329ae9dfd6742c84d79f7d143d10410f1b |
| Headers | show |
| Series | usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe | expand |
On 21-11-17 10:49:23, Dan Carpenter wrote: > If the first call to devm_usb_get_phy_by_phandle(dev, "fsl,usbphy", 0) > fails with something other than -ENODEV then it leads to an error > pointer dereference. For those errors we should just jump directly to > the error handling. > > Fixes: 8253a34bfae3 ("usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > drivers/usb/chipidea/ci_hdrc_imx.c | 18 +++++++++--------- > 1 file changed, 9 insertions(+), 9 deletions(-) > > diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c > index f1d100671ee6..097142ffb184 100644 > --- a/drivers/usb/chipidea/ci_hdrc_imx.c > +++ b/drivers/usb/chipidea/ci_hdrc_imx.c > @@ -420,15 +420,15 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) > data->phy = devm_usb_get_phy_by_phandle(dev, "fsl,usbphy", 0); > if (IS_ERR(data->phy)) { > ret = PTR_ERR(data->phy); > - if (ret == -ENODEV) { > - data->phy = devm_usb_get_phy_by_phandle(dev, "phys", 0); > - if (IS_ERR(data->phy)) { > - ret = PTR_ERR(data->phy); > - if (ret == -ENODEV) > - data->phy = NULL; > - else > - goto err_clk; > - } > + if (ret != -ENODEV) > + goto err_clk; > + data->phy = devm_usb_get_phy_by_phandle(dev, "phys", 0); > + if (IS_ERR(data->phy)) { > + ret = PTR_ERR(data->phy); > + if (ret == -ENODEV) > + data->phy = NULL; > + else > + goto err_clk; > } > } > > -- > 2.20.1 > Acked-by: Peter Chen <peter.chen@kernel.org>
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c index f1d100671ee6..097142ffb184 100644 --- a/drivers/usb/chipidea/ci_hdrc_imx.c +++ b/drivers/usb/chipidea/ci_hdrc_imx.c @@ -420,15 +420,15 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) data->phy = devm_usb_get_phy_by_phandle(dev, "fsl,usbphy", 0); if (IS_ERR(data->phy)) { ret = PTR_ERR(data->phy); - if (ret == -ENODEV) { - data->phy = devm_usb_get_phy_by_phandle(dev, "phys", 0); - if (IS_ERR(data->phy)) { - ret = PTR_ERR(data->phy); - if (ret == -ENODEV) - data->phy = NULL; - else - goto err_clk; - } + if (ret != -ENODEV) + goto err_clk; + data->phy = devm_usb_get_phy_by_phandle(dev, "phys", 0); + if (IS_ERR(data->phy)) { + ret = PTR_ERR(data->phy); + if (ret == -ENODEV) + data->phy = NULL; + else + goto err_clk; } }
If the first call to devm_usb_get_phy_by_phandle(dev, "fsl,usbphy", 0) fails with something other than -ENODEV then it leads to an error pointer dereference. For those errors we should just jump directly to the error handling. Fixes: 8253a34bfae3 ("usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/usb/chipidea/ci_hdrc_imx.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)