On Tue, Dec 17 2013, Andrzej Pietrasiewicz wrote:
> In the nokia gadget some USB functions (obex 1 and 2, phonet) are optional.
>
> If at the start of nokia_bind_config e.g. fi_phonet is an error pointer,
> which can happen because we don't fail the bind process if
> usb_get_function_instance() fails for fi_phonet, then f_phonet is NULL, and
>
> phonet_stat = usb_add_function(c, f_phonet);
>
> is never called and phonet_stat remains 0.
>
> If, in these circumstances, we hit the err_conf label then !phonet_stat
> evaluates to true and we try usb_remove_function() with its second
> parameter being f_phonet which is NULL and it causes NULL pointer
> dereference.
>
> This patch changes the initial values of (obex1|obex2|phonet)_stat to a
> nonzero value so that if the err_conf label is hit while the respective
> functions have not been acquired the usb_remove_function() is not called
> for those functions.
>
> Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@xxxxxxxxxxx>
As before:
Acked-by: Michal Nazarewicz <mina86@xxxxxxxxxx>
> ---
> v1..v2:
>
> - obex1/obex2/phonet_stat now initialized to -ENODEV instead of -1
>
> drivers/usb/gadget/nokia.c | 6 +++---
> 1 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/usb/gadget/nokia.c b/drivers/usb/gadget/nokia.c
> index 0a8099a..9598ed7 100644
> --- a/drivers/usb/gadget/nokia.c
> +++ b/drivers/usb/gadget/nokia.c
> @@ -126,9 +126,9 @@ static int __init nokia_bind_config(struct usb_configuration *c)
> struct usb_function *f_ecm;
> struct usb_function *f_obex2 = NULL;
> int status = 0;
> - int obex1_stat = 0;
> - int obex2_stat = 0;
> - int phonet_stat = 0;
> + int obex1_stat = -ENODEV;
> + int obex2_stat = -ENODEV;
> + int phonet_stat = -ENODEV;
>
> if (!IS_ERR(fi_phonet)) {
> f_phonet = usb_get_function(fi_phonet);
> --
> 1.7.0.4
>
--
Best regards, _ _
.o. | Liege of Serenely Enlightened Majesty of o' \,=./ `o
..o | Computer Science, Michał “mina86” Nazarewicz (o o)
ooo +--<mpn@xxxxxxxxxx>--<xmpp:mina86@xxxxxxxxxx>--ooO--(_)--Ooo--
Attachment:
signature.asc
Description: PGP signature
