Skip to content

Commit e762877

Browse files
shimodaygregkh
authored andcommitted
usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()
commit 894f2fc upstream. When unexpected situation happened (e.g. tx/rx irq happened while DMAC is used), the usbhsf_pkt_handler() was possible to cause NULL pointer dereference like the followings: Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = c0004000 [00000000] *pgd=00000000 Internal error: Oops: 80000007 [raspberrypi#1] SMP ARM Modules linked in: usb_f_acm u_serial g_serial libcomposite CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.5.0-rc6-00842-gac57066-dirty raspberrypi#63 Hardware name: Generic R8A7790 (Flattened Device Tree) task: c0729c00 ti: c0724000 task.ti: c0724000 PC is at 0x0 LR is at usbhsf_pkt_handler+0xac/0x118 pc : [<00000000>] lr : [<c03257e0>] psr: 60000193 sp : c0725db8 ip : 00000000 fp : c0725df4 r10: 00000001 r9 : 00000193 r8 : ef3ccab4 r7 : ef3cca10 r6 : eea4586c r5 : 00000000 r4 : ef19ceb4 r3 : 00000000 r2 : 0000009c r1 : c0725dc4 r0 : ef19ceb4 This patch adds a condition to avoid the dereference. Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support") Signed-off-by: Yoshihiro Shimoda <[email protected]> Signed-off-by: Felipe Balbi <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent 08f056a commit e762877

File tree

1 file changed

+2
-1
lines changed
  • drivers/usb/renesas_usbhs

1 file changed

+2
-1
lines changed

drivers/usb/renesas_usbhs/fifo.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,8 @@ static int usbhsf_pkt_handler(struct usbhs_pipe *pipe, int type)
190190
goto __usbhs_pkt_handler_end;
191191
}
192192

193-
ret = func(pkt, &is_done);
193+
if (likely(func))
194+
ret = func(pkt, &is_done);
194195

195196
if (is_done)
196197
__usbhsf_pkt_del(pkt);

0 commit comments

Comments
 (0)