xhci: host: potential NULL dereference in xhci_generic_plat_probe()
Subsystems (3)
PATCH 1/1 xhci: host: potential NULL dereference in xhci_generic_plat_probe()
It's possible to exit the loop with "sysdev" set to NULL. In that case we should use "&pdev->dev".
Fixes ec5499d338ec ("xhci: split out rcar/rz support from xhci-plat.c")
Signed-off-by Dan Carpenter <[email protected]>
--- drivers/usb/host/xhci-plat.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/host/xhci-plat.c +3 -0
@@ -368,6 +368,9 @@ static int xhci_generic_plat_probe(struct platform_device *pdev)#endif } +if (!sysdev) + sysdev = &pdev->dev; +if (WARN_ON (!sysdev->dma_mask)) {/* Platform did not initialize dma_mask */ ret =dma_coerce_mask_and_coherent (sysdev,DMA_BIT_MASK (64 ));
Signature · 1 line
2.35.1
Quoted 5 lines · Dan Carpenter
It's possible to exit the loop with "sysdev" set to NULL. In that case we should use "
&pdev->dev".Fixes ec5499d338ec ("xhci: split out rcar/rz support from xhci-plat.c")Signed-off-by Dan Carpenter <[email protected]>
Thanks for the fix!
I think this doesn't happen in practice because the loop should always find a firmware or PCI owned device, but it is clearly better to keep the original behavior from before my patch to be on the safe side here.
Acked-by Arnd Bergmann <[email protected]>
Quoted 18 lines
drivers/usb/host/xhci-plat.c | 3 +++ 1 file changed, 3 insertions(+)drivers/usb/host/xhci-plat.c +3
-0@@ -368,6 +368,9 @@ static int xhci_generic_plat_probe(struct platform_device *pdev)#endif } +if (!sysdev) + sysdev = &pdev->dev; +if (WARN_ON (!sysdev->dma_mask)) {/* Platform did not initialize dma_mask */ ret =
dma_coerce_mask_and_coherent(sysdev, DMA_BIT_MASK(64));