diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-06-15 14:27:19 +0300 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2020-06-30 22:38:05 +0300 |
| commit | a861f428586bfa4d09006cb4863e1f4d08d6f9ff (patch) | |
| tree | ff9e12e3a4de6e6f9637ceb18fd6d7b7b85ffdd8 /drivers/usb/gadget | |
| parent | 9be0376a05b0a80ad073773ad47dbe7f5d5e622f (diff) | |
| download | linux-a861f428586bfa4d09006cb4863e1f4d08d6f9ff.tar.xz | |
usb: gadget: udc: Potential Oops in error handling code
[ Upstream commit e55f3c37cb8d31c7e301f46396b2ac6a19eb3a7c ]
If this is in "transceiver" mode the the ->qwork isn't required and is
a NULL pointer. This can lead to a NULL dereference when we call
destroy_workqueue(udc->qwork).
Fixes: 3517c31a8ece ("usb: gadget: mv_udc: use devm_xxx for probe")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/usb/gadget')
| -rw-r--r-- | drivers/usb/gadget/udc/mv_udc_core.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c index 4103bf7cf52a..62fad60d0c06 100644 --- a/drivers/usb/gadget/udc/mv_udc_core.c +++ b/drivers/usb/gadget/udc/mv_udc_core.c @@ -2317,7 +2317,8 @@ static int mv_udc_probe(struct platform_device *pdev) return 0; err_create_workqueue: - destroy_workqueue(udc->qwork); + if (udc->qwork) + destroy_workqueue(udc->qwork); err_destroy_dma: dma_pool_destroy(udc->dtd_pool); err_free_dma: |