Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1478950 > unrolled thread

A potential bug in drivers/usb/gadget/udc/m66592-udc.ko

Back to article view | Back to linux.kernel

Contents

  A potential bug in drivers/usb/gadget/udc/m66592-udc.ko Pavel Andrianov <andrianov@ispras.ru> - 2016-09-08 11:20 +0200
    Re: A potential bug in drivers/usb/gadget/udc/m66592-udc.ko Felipe Balbi <felipe.balbi@linux.intel.com> - 2016-09-08 14:10 +0200

#1478950 — A potential bug in drivers/usb/gadget/udc/m66592-udc.ko

Hi!

There is a potential bug in drivers/usb/gadget/udc/m66592-udc.ko.
In m66592_probe interrupts are requested at line 1612. After that 
initialization of common resources is continued. For example, in

-> usb_add_gadget_udc (line 1678)
   -> usb_add_gadget_udc_release
     -> udc_bind_to_driver
       -> usb_gadget_udc_start
         -> m66592_udc_start

m66592->driver is set. In interrupt handler the data is used, thus if 
interrupt comes before udc_start is executed, null pointer dereference 
occurs.
Should the call of request_irq be after complete initialization?

-- 
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andrianov@ispras.ru

[toc] | [next] | [standalone]

#1479155

[Multipart message — attachments visible in raw view] — view raw

Hi,

Pavel Andrianov <andrianov@ispras.ru> writes:
> Hi!
>
> There is a potential bug in drivers/usb/gadget/udc/m66592-udc.ko.
> In m66592_probe interrupts are requested at line 1612. After that 
> initialization of common resources is continued. For example, in
>
> -> usb_add_gadget_udc (line 1678)
>    -> usb_add_gadget_udc_release
>      -> udc_bind_to_driver
>        -> usb_gadget_udc_start
>          -> m66592_udc_start
>
> m66592->driver is set. In interrupt handler the data is used, thus if 
> interrupt comes before udc_start is executed, null pointer dereference 
> occurs.
> Should the call of request_irq be after complete initialization?

interrupts will only fire after we connect data pullups, that's done by
->pullup() method waaaaaaaay later ;-)

-- 
balbi

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web