* A potential bug in drivers/usb/gadget/udc/m66592-udc.ko
@ 2016-09-08 9:18 Pavel Andrianov
2016-09-08 12:04 ` Felipe Balbi
0 siblings, 1 reply; 2+ messages in thread
From: Pavel Andrianov @ 2016-09-08 9:18 UTC (permalink / raw)
To: Felipe Balbi
Cc: Michal Nazarewicz, linux-kernel, ldv-project, Vaishali Thakkar
Hi!
There is a potential bug in drivers/usb/gadget/udc/m66592-udc.ko.
In m66592_probe interrupts are requested at line 1612. After that
initialization of common resources is continued. For example, in
-> usb_add_gadget_udc (line 1678)
-> usb_add_gadget_udc_release
-> udc_bind_to_driver
-> usb_gadget_udc_start
-> m66592_udc_start
m66592->driver is set. In interrupt handler the data is used, thus if
interrupt comes before udc_start is executed, null pointer dereference
occurs.
Should the call of request_irq be after complete initialization?
--
Pavel Andrianov
Linux Verification Center, ISPRAS
web: http://linuxtesting.org
e-mail: andrianov@ispras.ru
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: A potential bug in drivers/usb/gadget/udc/m66592-udc.ko
2016-09-08 9:18 A potential bug in drivers/usb/gadget/udc/m66592-udc.ko Pavel Andrianov
@ 2016-09-08 12:04 ` Felipe Balbi
0 siblings, 0 replies; 2+ messages in thread
From: Felipe Balbi @ 2016-09-08 12:04 UTC (permalink / raw)
To: Pavel Andrianov
Cc: Michal Nazarewicz, linux-kernel, ldv-project, Vaishali Thakkar
[-- Attachment #1: Type: text/plain, Size: 805 bytes --]
Hi,
Pavel Andrianov <andrianov@ispras.ru> writes:
> Hi!
>
> There is a potential bug in drivers/usb/gadget/udc/m66592-udc.ko.
> In m66592_probe interrupts are requested at line 1612. After that
> initialization of common resources is continued. For example, in
>
> -> usb_add_gadget_udc (line 1678)
> -> usb_add_gadget_udc_release
> -> udc_bind_to_driver
> -> usb_gadget_udc_start
> -> m66592_udc_start
>
> m66592->driver is set. In interrupt handler the data is used, thus if
> interrupt comes before udc_start is executed, null pointer dereference
> occurs.
> Should the call of request_irq be after complete initialization?
interrupts will only fire after we connect data pullups, that's done by
->pullup() method waaaaaaaay later ;-)
--
balbi
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 800 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-09-08 12:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-08 9:18 A potential bug in drivers/usb/gadget/udc/m66592-udc.ko Pavel Andrianov
2016-09-08 12:04 ` Felipe Balbi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome