diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-06-15 14:27:19 +0300 |
|---|---|---|
| committer | Felipe Balbi <balbi@kernel.org> | 2020-06-24 09:45:58 +0300 |
| commit | e55f3c37cb8d31c7e301f46396b2ac6a19eb3a7c (patch) | |
| tree | 9b376b1495d70365e0c5035589a2299adad2c235 /drivers/usb/gadget/udc/mv_udc_core.c | |
| parent | d410912ef63714fad404f34baa72e5ceb0466e62 (diff) | |
| download | linux-stable-e55f3c37cb8d31c7e301f46396b2ac6a19eb3a7c.tar.gz linux-stable-e55f3c37cb8d31c7e301f46396b2ac6a19eb3a7c.tar.bz2 linux-stable-e55f3c37cb8d31c7e301f46396b2ac6a19eb3a7c.zip | |
usb: gadget: udc: Potential Oops in error handling code
If this is in "transceiver" mode the the ->qwork isn't required and is
a NULL pointer. This can lead to a NULL dereference when we call
destroy_workqueue(udc->qwork).
Fixes: 3517c31a8ece ("usb: gadget: mv_udc: use devm_xxx for probe")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Diffstat (limited to 'drivers/usb/gadget/udc/mv_udc_core.c')
| -rw-r--r-- | drivers/usb/gadget/udc/mv_udc_core.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c index cafde053788b..80a1b52c656e 100644 --- a/drivers/usb/gadget/udc/mv_udc_core.c +++ b/drivers/usb/gadget/udc/mv_udc_core.c @@ -2313,7 +2313,8 @@ static int mv_udc_probe(struct platform_device *pdev) return 0; err_create_workqueue: - destroy_workqueue(udc->qwork); + if (udc->qwork) + destroy_workqueue(udc->qwork); err_destroy_dma: dma_pool_destroy(udc->dtd_pool); err_free_dma: |