From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933062AbcBZOwi (ORCPT ); Fri, 26 Feb 2016 09:52:38 -0500 Received: from www.linutronix.de ([62.245.132.108]:60109 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932066AbcBZOwg (ORCPT ); Fri, 26 Feb 2016 09:52:36 -0500 From: John Ogness To: Felipe Balbi To: Bin Liu To: Greg Kroah-Hartman To: linux-usb@vger.kernel.org To: linux-kernel@vger.kernel.org Subject: [PATCH] usb: musb: gadget: fix possible NULL pointer dereference Date: Fri, 26 Feb 2016 15:52:29 +0100 Message-ID: <87bn73frrm.fsf@linutronix.de> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.4 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Linutronix-Spam-Score: -1.0 X-Linutronix-Spam-Level: - X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required, ALL_TRUSTED=-1,SHORTCIRCUIT=-0.0001,URIBL_BLOCKED=0.001 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org txstate() assumes that if the request buffer is mapped, a DMA channel is allocated. There is a case here where the DMA channel is released and then shortly thereafter (in general PIO code) the request buffer is unmapped. However, in this case unmap_dma_buffer() silently fails because the DMA channel is already gone. Thus, the next time txstate() is called, there is a NULL pointer exception because the buffer is mapped but no DMA channel is allocated. This patch adds an extra call unmap_dma_buffer() before releasing the channel. Signed-off-by: John Ogness --- patch against next-20160226 drivers/usb/musb/musb_gadget.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c index 87bd578..c518d3c 100644 --- a/drivers/usb/musb/musb_gadget.c +++ b/drivers/usb/musb/musb_gadget.c @@ -393,6 +393,7 @@ static void txstate(struct musb *musb, struct musb_request *req) request->dma + request->actual, request_size); if (!use_dma) { + unmap_dma_buffer(req, musb); c->channel_release(musb_ep->dma); musb_ep->dma = NULL; csr &= ~MUSB_TXCSR_DMAENAB; -- 1.7.10.4