[PATCH] usb: dwc3: host: fix props[] overflow and dangling xhci pointer on error

[David Collin <davidcollin899@gmail.com>]

props[] is sized for exactly the number of properties dwc3_host_init()
can populate, leaving no slot for the NULL terminator
property_entries_dup() requires when usb3_lpm_capable,
usb2_lpm_disable, and the <=3.00a PED quirk are all true. Size props[]
for one more slot.

This also clears dwc->xhci on the error path and adds a NULL check in
dwc3_host_exit(), since a failed dwc3_host_init() otherwise leaves a
dangling pointer that dwc3_host_exit() dereferences unconditionally on
removal/shutdown.

Fixes: 8da7644493b4 ("usb: dwc3: Specify maximum number of XHCI interrupters")

Signed-off-by: David Collin <davidcollin899@gmail.com>
---
 drivers/usb/dwc3/host.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c
index c5674161b..cd1e5204a 100644
--- a/drivers/usb/dwc3/host.c
+++ b/drivers/usb/dwc3/host.c
@@ -130,7 +130,7 @@ static int dwc3_host_get_irq(struct dwc3 *dwc)
 
 int dwc3_host_init(struct dwc3 *dwc)
 {
-	struct property_entry	props[6];
+	struct property_entry	props[7];
 	struct platform_device	*xhci;
 	int			ret, irq;
 	int			prop_idx = 0;
@@ -219,12 +219,16 @@ int dwc3_host_init(struct dwc3 *dwc)
 	return 0;
 err:
 	platform_device_put(xhci);
+	dwc->xhci = NULL;
 	return ret;
 }
 EXPORT_SYMBOL_GPL(dwc3_host_init);
 
 void dwc3_host_exit(struct dwc3 *dwc)
 {
+	if (!dwc->xhci)
+		return;
+
 	if (dwc->sys_wakeup)
 		device_init_wakeup(&dwc->xhci->dev, false);
 
-- 
2.55.0