usb: gadget: udc: add null check before pointer dereference

Add null check before dereferencing dev->regs pointer inside net2280_led_shutdown() function.

Addresses-Coverity-ID: 101783

Signed-off-by Gustavo A. R. Silva <[email protected]>

---
 drivers/usb/gadget/udc/net2280.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

drivers/usb/gadget/udc/net2280.c +5 -1

index 3828c2e..1898a4b 100644
@@ -3573,7 +3573,11 @@ static void net2280_remove(struct pci_dev *pdev)
 	BUG_ON(dev->driver);
 
 	/* then clean up the resources we allocated during probe() */
-	net2280_led_shutdown(dev);
+
+	if (dev->regs) {
+		net2280_led_shutdown(dev);
+		iounmap(dev->regs);
+	}
 	if (dev->requests) {
 		int		i;
 		for (i = 1; i < 5; i++) {

Quoted 31 lines

Add null check before dereferencing dev->regs pointer inside net2280_led_shutdown() function.

Addresses-Coverity-ID: 101783

Signed-off-by Gustavo A. R. Silva <[email protected]>

---
 drivers/usb/gadget/udc/net2280.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

drivers/usb/gadget/udc/net2280.c +5 -1

index 3828c2e..1898a4b 100644
@@ -3573,7 +3573,11 @@ static void net2280_remove(struct pci_dev *pdev)
 	BUG_ON(dev->driver);
 
 	/* then clean up the resources we allocated during probe() */
-	net2280_led_shutdown(dev);
+
+	if (dev->regs) {
+		net2280_led_shutdown(dev);
+		iounmap(dev->regs);
+	}
 	if (dev->requests) {
 		int		i;
 		for (i = 1; i < 5; i++) {

@@ -3588,8 +3592,6 @@ static void net2280_remove(struct pci_dev *pdev)
 		free_irq(pdev->irq, dev);
 	if (dev->quirks & PLX_PCIE)
 		pci_disable_msi(pdev);

drivers/usb/gadget/udc/net2280.c static void net2280_remove(struct pci_dev *pdev) · line 3597

Quoted 5 lines

drivers/usb/gadget/udc/net2280.c +0 -2

-	if (dev->regs)
-		iounmap(dev->regs);
 	if (dev->region)
 		release_mem_region(pci_resource_start(pdev, 0),
 				pci_resource_len(pdev, 0));

No, you must not move the iounmap() call, because an interrupt could theoretically occur at any time.

Either just live with an extra test of dev->regs, or else move the net2280_led_shutdown() call later.

Add null check before dereferencing dev->regs pointer inside net2280_led_shutdown() function.

Addresses-Coverity-ID: 101783

Cc Alan Stern <[email protected]>

Signed-off-by Gustavo A. R. Silva <[email protected]>

---
Changes in v2:
Move the net2280_led_shutdown() call later.

 drivers/usb/gadget/udc/net2280.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

drivers/usb/gadget/udc/net2280.c +0 -1

index 3828c2e..4f5c0c4 100644
@@ -3573,7 +3573,6 @@ static void net2280_remove(struct pci_dev *pdev)
 	BUG_ON(dev->driver);
 
 	/* then clean up the resources we allocated during probe() */
-	net2280_led_shutdown(dev);
 	if (dev->requests) {
 		int		i;
 		for (i = 1; i < 5; i++) {

@@ -3588,8 +3587,10 @@ static void net2280_remove(struct pci_dev *pdev)
 		free_irq(pdev->irq, dev);