The patch titled usb: fsl_qe_udc: Fix oops on QE UDC probe failure has been added to the -mm tree. Its filename is usb-fsl_qe_udc-fix-oops-on-qe-udc-probe-failure.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: usb: fsl_qe_udc: Fix oops on QE UDC probe failure From: Anton Vorontsov <avorontsov@xxxxxxxxxxxxx> In case of probing errors the driver kfrees the udc_controller, but it doesn't set the pointer to NULL. When usb_gadget_register_driver is called, it checks for udc_controller != NULL, the check passes and the driver accesses nonexistent memory. Fix this by setting udc_controller to NULL in case of errors. While at it, also implement irq_of_parse_and_map()'s failure and cleanup cases. Signed-off-by: Anton Vorontsov <avorontsov@xxxxxxxxxxxxx> Acked-by: David Brownell <dbrownell@xxxxxxxxxxxxxxxxxxxxx> Cc: Greg KH <greg@xxxxxxxxx> Cc: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/usb/gadget/fsl_qe_udc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff -puN drivers/usb/gadget/fsl_qe_udc.c~usb-fsl_qe_udc-fix-oops-on-qe-udc-probe-failure drivers/usb/gadget/fsl_qe_udc.c --- a/drivers/usb/gadget/fsl_qe_udc.c~usb-fsl_qe_udc-fix-oops-on-qe-udc-probe-failure +++ a/drivers/usb/gadget/fsl_qe_udc.c @@ -2604,6 +2604,10 @@ static int __devinit qe_udc_probe(struct (unsigned long)udc_controller); /* request irq and disable DR */ udc_controller->usb_irq = irq_of_parse_and_map(np, 0); + if (!udc_controller->usb_irq) { + ret = -EINVAL; + goto err_noirq; + } ret = request_irq(udc_controller->usb_irq, qe_udc_irq, 0, driver_name, udc_controller); @@ -2625,6 +2629,8 @@ static int __devinit qe_udc_probe(struct err6: free_irq(udc_controller->usb_irq, udc_controller); err5: + irq_dispose_mapping(udc_controller->usb_irq); +err_noirq: if (udc_controller->nullmap) { dma_unmap_single(udc_controller->gadget.dev.parent, udc_controller->nullp, 256, @@ -2648,7 +2654,7 @@ err2: iounmap(udc_controller->usb_regs); err1: kfree(udc_controller); - + udc_controller = NULL; return ret; } @@ -2710,6 +2716,7 @@ static int __devexit qe_udc_remove(struc kfree(ep->txframe); free_irq(udc_controller->usb_irq, udc_controller); + irq_dispose_mapping(udc_controller->usb_irq); tasklet_kill(&udc_controller->rx_tasklet); _ Patches currently in -mm which might be from avorontsov@xxxxxxxxxxxxx are origin.patch linux-next.patch usb-driver-for-freescale-quicc-engine-usb-host-controller.patch usb-fsl_qe_udc-fix-oops-on-qe-udc-probe-failure.patch usb-fsl_qe_udc-fix-recursive-locking-bug-in-ch9getstatus.patch usb-fsl_qe_udc-fix-qe-usb-controller-initialization.patch usb-fsl_qe_udc-fix-disconnects-reporting-during-bus-reset.patch usb-fsl_qe_udc-fix-muram-corruption-by-disabled-endpoints.patch usb-fsl_qe_udc-fix-stalled-tx-requests-bug.patch rtc-bunch-of-drivers-fix-no-irq-case-handing.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html