[PATCH] USB: EHCI: tegra: Fix oops in error cleanup

[PATCH] USB: EHCI: tegra: Fix oops in error cleanup

[Thierry Reding]

Under some circumstances it happens that the connected PHY can't be
powered up properly, in which case the cleanup path currently crashes
because it checks the tegra->transceiver field using !IS_ERR(), which
will succeed because it is in fact NULL. Dereferencing that pointer
causes an oops in tegra_ehci_probe().

This patch fixes the issue by adding an additional label into the
cleanup path to separately take down the PHY and the transceiver.

Signed-off-by: Thierry Reding <thierry.reding-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
---
Note: This is based on top of Stephen's latest patch series to allow
building the driver as a module:

[PATCH V3 REPOST 0/7] USB: tegra: support building as a module

 drivers/usb/host/ehci-tegra.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c
index 8dac5e4..6ee7ef7 100644
--- a/drivers/usb/host/ehci-tegra.c
+++ b/drivers/usb/host/ehci-tegra.c
@@ -478,15 +478,15 @@ static int tegra_ehci_probe(struct platform_device *pdev)
 	err = usb_add_hcd(hcd, irq, IRQF_SHARED);
 	if (err) {
 		dev_err(&pdev->dev, "Failed to add USB HCD\n");
-		goto cleanup_phy;
+		goto cleanup_transceiver;
 	}
 
 	return err;
 
-cleanup_phy:
+cleanup_transceiver:
 	if (!IS_ERR(tegra->transceiver))
 		otg_set_host(tegra->transceiver->otg, NULL);

Re: [PATCH] USB: EHCI: tegra: Fix oops in error cleanup

[Stephen Warren]

On 06/14/2013 05:21 AM, Thierry Reding wrote:
> Under some circumstances it happens that the connected PHY can't be
> powered up properly, in which case the cleanup path currently crashes
> because it checks the tegra->transceiver field using !IS_ERR(), which
> will succeed because it is in fact NULL. Dereferencing that pointer
> causes an oops in tegra_ehci_probe().
> 
> This patch fixes the issue by adding an additional label into the
> cleanup path to separately take down the PHY and the transceiver.

Reviewed-by: Stephen Warren <swarren-DDmLM1+adcrQT0dZR+AlfA@public.gmane.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] USB: EHCI: tegra: Fix oops in error cleanup

[Alan Stern]

On Fri, 14 Jun 2013, Thierry Reding wrote:

> Under some circumstances it happens that the connected PHY can't be
> powered up properly, in which case the cleanup path currently crashes
> because it checks the tegra->transceiver field using !IS_ERR(), which
> will succeed because it is in fact NULL. Dereferencing that pointer
> causes an oops in tegra_ehci_probe().
> 
> This patch fixes the issue by adding an additional label into the
> cleanup path to separately take down the PHY and the transceiver.
> 
> Signed-off-by: Thierry Reding <thierry.reding-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>

Acked-by: Alan Stern <stern-nwvwT67g6+6dFdvTe/nMLpVzexx5G7lz@public.gmane.org>

This looks a lot like a repeat of 369a9a9d2af7 (usb: host: ehci-tegra:  
Fix oops in error cleanup).  Evidently someone wasn't very careful when
changing the names of the statement labels.  Or maybe a merge conflict 
was resolved incorrectly.

Alan Stern