From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:49213 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754854AbbG3Bt7 (ORCPT ); Wed, 29 Jul 2015 21:49:59 -0400 Subject: Patch "usb: gadget: composite: Fix NULL pointer dereference" has been added to the 4.1-stable tree To: kishon@ti.com, balbi@ti.com, gregkh@linuxfoundation.org Cc: , From: Date: Wed, 29 Jul 2015 18:49:57 -0700 Message-ID: <1438220997182236@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled usb: gadget: composite: Fix NULL pointer dereference to the 4.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: usb-gadget-composite-fix-null-pointer-dereference.patch and it can be found in the queue-4.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From b4c21f0bdd2c0cd5d5be1bb56f0a28dae5041eed Mon Sep 17 00:00:00 2001 From: Kishon Vijay Abraham I Date: Thu, 11 Jun 2015 22:12:11 +0530 Subject: usb: gadget: composite: Fix NULL pointer dereference From: Kishon Vijay Abraham I commit b4c21f0bdd2c0cd5d5be1bb56f0a28dae5041eed upstream. commit f563d230903210acc ("usb: gadget: composite: add req_match method to usb_function") accesses cdev->config even before set config is invoked causing a NULL pointer dereferencing error while running Lecroy Mass Storage Compliance test. Fix it here by accessing cdev->config only if it is non NULL. Fixes: commit f563d230903210acc ("usb: gadget: composite: add req_match method to usb_function"). Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/composite.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -1758,10 +1758,13 @@ unknown: * take such requests too, if that's ever needed: to work * in config 0, etc. */ - list_for_each_entry(f, &cdev->config->functions, list) - if (f->req_match && f->req_match(f, ctrl)) - goto try_fun_setup; - f = NULL; + if (cdev->config) { + list_for_each_entry(f, &cdev->config->functions, list) + if (f->req_match && f->req_match(f, ctrl)) + goto try_fun_setup; + f = NULL; + } + switch (ctrl->bRequestType & USB_RECIP_MASK) { case USB_RECIP_INTERFACE: if (!cdev->config || intf >= MAX_CONFIG_INTERFACES) Patches currently in stable-queue which might be from kishon@ti.com are queue-4.1/phy-berlin-usb-fix-divider-for-bg2cd.patch queue-4.1/phy-twl4030-usb-remove-incorrect-pm_runtime_get_sync-in-probe-function.patch queue-4.1/usb-gadget-composite-fix-null-pointer-dereference.patch