From: Felipe Balbi <felipe.balbi@linux.intel.com>
To: Pavel Andrianov <andrianov@ispras.ru>
Cc: Michal Nazarewicz <mina86@mina86.com>,
linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org,
Vaishali Thakkar <vaishali.thakkar@oracle.com>
Subject: Re: A potential bug in drivers/usb/gadget/udc/m66592-udc.ko
Date: Thu, 08 Sep 2016 15:04:15 +0300 [thread overview]
Message-ID: <87lgz2ha2o.fsf@linux.intel.com> (raw)
In-Reply-To: <7e61bfab-513e-da45-acd6-f3f3998d46e6@ispras.ru>
[-- Attachment #1: Type: text/plain, Size: 805 bytes --]
Hi,
Pavel Andrianov <andrianov@ispras.ru> writes:
> Hi!
>
> There is a potential bug in drivers/usb/gadget/udc/m66592-udc.ko.
> In m66592_probe interrupts are requested at line 1612. After that
> initialization of common resources is continued. For example, in
>
> -> usb_add_gadget_udc (line 1678)
> -> usb_add_gadget_udc_release
> -> udc_bind_to_driver
> -> usb_gadget_udc_start
> -> m66592_udc_start
>
> m66592->driver is set. In interrupt handler the data is used, thus if
> interrupt comes before udc_start is executed, null pointer dereference
> occurs.
> Should the call of request_irq be after complete initialization?
interrupts will only fire after we connect data pullups, that's done by
->pullup() method waaaaaaaay later ;-)
--
balbi
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 800 bytes --]
prev parent reply other threads:[~2016-09-08 12:05 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-08 9:18 A potential bug in drivers/usb/gadget/udc/m66592-udc.ko Pavel Andrianov
2016-09-08 12:04 ` Felipe Balbi [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87lgz2ha2o.fsf@linux.intel.com \
--to=felipe.balbi@linux.intel.com \
--cc=andrianov@ispras.ru \
--cc=ldv-project@linuxtesting.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mina86@mina86.com \
--cc=vaishali.thakkar@oracle.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.