usb: gadget: udc: Potential Oops in error handling code

PATCH New Dan Carpenter 1 participant 1 message Jun 15, 2020

Subsystems (2)

USB Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2020-06-15 11:27 UTC #0 lore raw

PATCH 1/1 usb: gadget: udc: Potential Oops in error handling code

If this is in "transceiver" mode the the ->qwork isn't required and is a NULL pointer. This can lead to a NULL dereference when we call destroy_workqueue(udc->qwork).

Fixes 3517c31a8ece ("usb: gadget: mv_udc: use devm_xxx for probe")

Signed-off-by Dan Carpenter <[email protected]>

---
 drivers/usb/gadget/udc/mv_udc_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/usb/gadget/udc/mv_udc_core.c +2 -1

index cafde053788bb..80a1b52c656e0 100644
@@ -2313,7 +2313,8 @@ static int mv_udc_probe(struct platform_device *pdev)
 	return 0;
 
 err_create_workqueue:
-	destroy_workqueue(udc->qwork);
+	if (udc->qwork)
+		destroy_workqueue(udc->qwork);
 err_destroy_dma:
 	dma_pool_destroy(udc->dtd_pool);
 err_free_dma:

Signature · 1 line

2.26.2