From: David Brownell <david-b@pacbell•net>
To: Anton Vorontsov <avorontsov@ru•mvista.com>
Cc: Greg Kroah-Hartman <greg@kroah•com>,
Li Yang <leoli@freescale•com>,
linux-usb@vger•kernel.org, linuxppc-dev@ozlabs•org
Subject: Re: [PATCH 1/6] usb/fsl_qe_udc: Fix oops on QE UDC probe failure
Date: Mon, 17 Nov 2008 17:55:00 -0800 [thread overview]
Message-ID: <200811171755.00521.david-b@pacbell.net> (raw)
In-Reply-To: <20081111160320.GA24699@oksana.dev.rtsoft.ru>
On Tuesday 11 November 2008, Anton Vorontsov wrote:
> In case of probing errors the driver kfrees the udc_controller, but it
> doesn't set the pointer to NULL.
>
> When usb_gadget_register_driver is called, it checks for udc_controller
> != NULL, the check passes and the driver accesses nonexistent memory.
> Fix this by setting udc_controller to NULL in case of errors.
>
> While at it, also implement irq_of_parse_and_map()'s failure and cleanup
> cases.
>
> Signed-off-by: Anton Vorontsov <avorontsov@ru•mvista.com>
Acked-by: David Brownell <dbrownell@users•sourceforge.net>
I seem to detect a lot of bugfix activity here, which
tends to reflect usage ... good! :)
> ---
> drivers/usb/gadget/fsl_qe_udc.c | 9 ++++++++-
> 1 files changed, 8 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/usb/gadget/fsl_qe_udc.c b/drivers/usb/gadget/fsl_qe_udc.c
> index 94c38e4..60b9279 100644
> --- a/drivers/usb/gadget/fsl_qe_udc.c
> +++ b/drivers/usb/gadget/fsl_qe_udc.c
> @@ -2601,6 +2601,10 @@ static int __devinit qe_udc_probe(struct of_device *ofdev,
> (unsigned long)udc_controller);
> /* request irq and disable DR */
> udc_controller->usb_irq = irq_of_parse_and_map(np, 0);
> + if (!udc_controller->usb_irq) {
> + ret = -EINVAL;
> + goto err_noirq;
> + }
>
> ret = request_irq(udc_controller->usb_irq, qe_udc_irq, 0,
> driver_name, udc_controller);
> @@ -2622,6 +2626,8 @@ static int __devinit qe_udc_probe(struct of_device *ofdev,
> err6:
> free_irq(udc_controller->usb_irq, udc_controller);
> err5:
> + irq_dispose_mapping(udc_controller->usb_irq);
> +err_noirq:
> if (udc_controller->nullmap) {
> dma_unmap_single(udc_controller->gadget.dev.parent,
> udc_controller->nullp, 256,
> @@ -2645,7 +2651,7 @@ err2:
> iounmap(udc_controller->usb_regs);
> err1:
> kfree(udc_controller);
> -
> + udc_controller = NULL;
> return ret;
> }
>
> @@ -2707,6 +2713,7 @@ static int __devexit qe_udc_remove(struct of_device *ofdev)
> kfree(ep->txframe);
>
> free_irq(udc_controller->usb_irq, udc_controller);
> + irq_dispose_mapping(udc_controller->usb_irq);
>
> tasklet_kill(&udc_controller->rx_tasklet);
>
> --
> 1.5.6.3
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-usb" in
> the body of a message to majordomo@vger•kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
>
next prev parent reply other threads:[~2008-11-18 2:14 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-11-11 16:01 [PATCH 0/6] More QE UDC fixes Anton Vorontsov
2008-11-11 16:03 ` [PATCH 1/6] usb/fsl_qe_udc: Fix oops on QE UDC probe failure Anton Vorontsov
2008-11-18 1:55 ` David Brownell [this message]
2008-11-11 16:03 ` [PATCH 2/6] usb/fsl_qe_udc: Fix recursive locking bug in ch9getstatus() Anton Vorontsov
2008-11-18 1:59 ` David Brownell
2008-11-18 17:51 ` [PATCH 2/6 v2] " Anton Vorontsov
2008-11-18 22:13 ` David Brownell
2008-11-19 0:20 ` [PATCH 2/6 v3] " Anton Vorontsov
2008-11-20 5:41 ` David Brownell
2008-11-11 16:03 ` [PATCH 3/6] usb/fsl_qe_udc: Fix QE USB controller initialization Anton Vorontsov
2008-11-11 16:03 ` [PATCH 4/6] usb/fsl_qe_udc: Fix disconnects reporting during bus reset Anton Vorontsov
2008-11-18 1:48 ` David Brownell
2008-11-11 16:03 ` [PATCH 5/6] usb/fsl_qe_udc: Fix muram corruption by disabled endpoints Anton Vorontsov
2008-11-18 1:52 ` David Brownell
2008-11-11 16:03 ` [PATCH 6/6] usb/fsl_qe_udc: Fix stalled TX requests bug Anton Vorontsov
2008-11-18 1:53 ` David Brownell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200811171755.00521.david-b@pacbell.net \
--to=david-b@pacbell$(echo .)net \
--cc=avorontsov@ru$(echo .)mvista.com \
--cc=dbrownell@users$(echo .)sourceforge.net \
--cc=greg@kroah$(echo .)com \
--cc=leoli@freescale$(echo .)com \
--cc=linux-usb@vger$(echo .)kernel.org \
--cc=linuxppc-dev@ozlabs$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox