diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-06-15 14:27:19 +0300 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2020-06-29 20:08:02 -0400 |
| commit | ea8532dd6fb6befe355d027fe51cc8d560fa1bce (patch) | |
| tree | 47499bc367f4c451a4f3d0ec27c4e8873f98b5a5 | |
| parent | fb0b63ed4084d97fce4355f2b86174136505944a (diff) | |
usb: gadget: udc: Potential Oops in error handling code
[ Upstream commit e55f3c37cb8d31c7e301f46396b2ac6a19eb3a7c ]
If this is in "transceiver" mode the the ->qwork isn't required and is
a NULL pointer. This can lead to a NULL dereference when we call
destroy_workqueue(udc->qwork).
Fixes: 3517c31a8ece ("usb: gadget: mv_udc: use devm_xxx for probe")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/usb/gadget/udc/mv_udc_core.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c index 81b6229c7805..4f480059f851 100644 --- a/drivers/usb/gadget/udc/mv_udc_core.c +++ b/drivers/usb/gadget/udc/mv_udc_core.c @@ -2322,7 +2322,8 @@ static int mv_udc_probe(struct platform_device *pdev) return 0; err_create_workqueue: - destroy_workqueue(udc->qwork); + if (udc->qwork) + destroy_workqueue(udc->qwork); err_destroy_dma: dma_pool_destroy(udc->dtd_pool); err_free_dma: |