Patch "usb: gadget: composite: Fix NULL pointer dereference" has been added to the 4.1-stable tree

Patch "usb: gadget: composite: Fix NULL pointer dereference" has been added to the 4.1-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    usb: gadget: composite: Fix NULL pointer dereference

to the 4.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-gadget-composite-fix-null-pointer-dereference.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From b4c21f0bdd2c0cd5d5be1bb56f0a28dae5041eed Mon Sep 17 00:00:00 2001
From: Kishon Vijay Abraham I <kishon@ti.com>
Date: Thu, 11 Jun 2015 22:12:11 +0530
Subject: usb: gadget: composite: Fix NULL pointer dereference

From: Kishon Vijay Abraham I <kishon@ti.com>

commit b4c21f0bdd2c0cd5d5be1bb56f0a28dae5041eed upstream.

commit f563d230903210acc ("usb: gadget: composite: add req_match method
to usb_function") accesses cdev->config even before set config
is invoked causing a NULL pointer dereferencing error while running
Lecroy Mass Storage Compliance test.

Fix it here by accessing cdev->config only if it is non NULL.

Fixes: commit f563d230903210acc ("usb: gadget: composite: add req_match
method to usb_function").

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/composite.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1758,10 +1758,13 @@ unknown:
 		 * take such requests too, if that's ever needed:  to work
 		 * in config 0, etc.
 		 */
-		list_for_each_entry(f, &cdev->config->functions, list)
-			if (f->req_match && f->req_match(f, ctrl))
-				goto try_fun_setup;
-		f = NULL;
+		if (cdev->config) {
+			list_for_each_entry(f, &cdev->config->functions, list)
+				if (f->req_match && f->req_match(f, ctrl))
+					goto try_fun_setup;
+			f = NULL;
+		}
+
 		switch (ctrl->bRequestType & USB_RECIP_MASK) {
 		case USB_RECIP_INTERFACE:
 			if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)


Patches currently in stable-queue which might be from kishon@ti.com are

queue-4.1/phy-berlin-usb-fix-divider-for-bg2cd.patch
queue-4.1/phy-twl4030-usb-remove-incorrect-pm_runtime_get_sync-in-probe-function.patch
queue-4.1/usb-gadget-composite-fix-null-pointer-dereference.patch