Skip to contentSkip to conversation

usb: chipidea: udc: fix potential kernel panic

PATCH New 21cnbao at gmail.com 2 participants 2 messages Jun 4, 2013 – Aug 2, 2013

Subsystems (2)
USB Chipidea USB high speed dual role controller
lore
Share & tools
lore

21cnbao at gmail.com

author
#0 lore raw

PATCH 1/1 usb: chipidea: udc: fix potential kernel panic

From: Rong Wang <[email protected]>

If global_phy is used when CONFIG_USB_PHY is not defined, usb_get_phy() returns ERR_PTR(-ENXIO). If we only check ci->transceiver is NULL or not in vbus_draw callback, it will return true and continue to dereference ERR_PTR(-ENXIO) which will cause a kernel panic.

Tested on CSR SiRFatlasVI SoC platform which licensed chipidea.

Signed-off-by Rong Wang <[email protected]>
Signed-off-by Barry Song <[email protected]>
---
 drivers/usb/chipidea/udc.c |    7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)
drivers/usb/chipidea/udc.c +4 -3
index 519ead2..822194b 100644
@@ -1392,7 +1392,7 @@ static int ci13xxx_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
 {
 	struct ci13xxx *ci = container_of(_gadget, struct ci13xxx, gadget);
 
-	if (ci->transceiver)
+	if (!IS_ERR_OR_NULL(ci->transceiver))
 		return usb_phy_set_power(ci->transceiver, mA);
 	return -ENOTSUPP;
 }

@@ -1682,8 +1682,9 @@ static int udc_start(struct ci13xxx *ci)
 		ci->transceiver = usb_get_phy(USB_PHY_TYPE_USB2);
 
 	if (ci->platdata->flags & CI13XXX_REQUIRE_TRANSCEIVER) {
-		if (ci->transceiver == NULL) {
-			retval = -ENODEV;
+		if (IS_ERR_OR_NULL(ci->transceiver)) {
+			retval = ci->transceiver ?
+				PTR_ERR(ci->transceiver) : -ENODEV;
 			goto destroy_eps;
 		}
 	}
Signature · 1 line
1.7.5.4
#1 lore raw

PATCH 1/1 usb: chipidea: udc: fix potential kernel panic

Quoted 7 lines · On Tue, Jun 04, 2013 at 08:17:57PM +0800, 21cnbao at gmail.com wrote:

From: Rong Wang <[email protected]>

If global_phy is used when CONFIG_USB_PHY is not defined, usb_get_phy() returns ERR_PTR(-ENXIO). If we only check ci->transceiver is NULL or not in vbus_draw callback, it will return true and continue to dereference ERR_PTR(-ENXIO) which will cause a kernel panic.

If global_phy is used, the ci->transceiver should be NULL, see below code at drivers/usb/chipidea/udc.c.

1799 if (ci->global_phy) {
1800 ci->transceiver = usb_get_phy(USB_PHY_TYPE_USB2);
1801 if (IS_ERR(ci->transceiver))
1802 ci->transceiver = NULL;
1803 }

Quoted 42 lines

Tested on CSR SiRFatlasVI SoC platform which licensed chipidea.

Signed-off-by Rong Wang <[email protected]>
Signed-off-by Barry Song <[email protected]>
---
 drivers/usb/chipidea/udc.c |    7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)
drivers/usb/chipidea/udc.c +4 -3
index 519ead2..822194b 100644
@@ -1392,7 +1392,7 @@ static int ci13xxx_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
 {
 	struct ci13xxx *ci = container_of(_gadget, struct ci13xxx, gadget);
 
-	if (ci->transceiver)
+	if (!IS_ERR_OR_NULL(ci->transceiver))
 		return usb_phy_set_power(ci->transceiver, mA);
 	return -ENOTSUPP;
 }

@@ -1682,8 +1682,9 @@ static int udc_start(struct ci13xxx *ci)
 		ci->transceiver = usb_get_phy(USB_PHY_TYPE_USB2);
 
 	if (ci->platdata->flags & CI13XXX_REQUIRE_TRANSCEIVER) {
-		if (ci->transceiver == NULL) {
-			retval = -ENODEV;
+		if (IS_ERR_OR_NULL(ci->transceiver)) {
+			retval = ci->transceiver ?
+				PTR_ERR(ci->transceiver) : -ENODEV;
 			goto destroy_eps;
 		}
 	}
Signature · 6 lines
1.7.5.4

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Signature · 2 lines
Best Regards,
Peter Chen