From patchwork Mon Nov 20 18:33:39 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heinrich Schuchardt X-Patchwork-Id: 839681 X-Patchwork-Delegate: marek.vasut@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.denx.de (client-ip=81.169.180.215; helo=lists.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Received: from lists.denx.de (dione.denx.de [81.169.180.215]) by ozlabs.org (Postfix) with ESMTP id 3ygcvR3LcDz9s71 for ; Tue, 21 Nov 2017 05:39:31 +1100 (AEDT) Received: by lists.denx.de (Postfix, from userid 105) id C2AB1C220D1; Mon, 20 Nov 2017 18:37:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on lists.denx.de X-Spam-Level: X-Spam-Status: No, score=-0.0 required=5.0 tests=FREEMAIL_FROM, RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL autolearn=unavailable autolearn_force=no version=3.4.0 Received: from lists.denx.de (localhost [IPv6:::1]) by lists.denx.de (Postfix) with ESMTP id 56CC4C220ED; Mon, 20 Nov 2017 18:37:31 +0000 (UTC) Received: by lists.denx.de (Postfix, from userid 105) id CCB21C220C1; Mon, 20 Nov 2017 18:33:53 +0000 (UTC) Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) by lists.denx.de (Postfix) with ESMTPS id 045F6C220DA for ; Mon, 20 Nov 2017 18:33:49 +0000 (UTC) Received: from LPT2.fritz.box ([94.114.42.150]) by mail.gmx.com (mrgmx102 [212.227.17.174]) with ESMTPSA (Nemesis) id 0MATlG-1eRHHv28Gw-00BgGb; Mon, 20 Nov 2017 19:33:45 +0100 From: Heinrich Schuchardt To: Marek Vasut Date: Mon, 20 Nov 2017 19:33:39 +0100 Message-Id: <20171120183339.15120-1-xypron.glpk@gmx.de> X-Mailer: git-send-email 2.15.0 X-Provags-ID: V03:K0:zmNJS8xtVVv7RqxGg+pJCpjtReDQF28WvMMchgxP/HZGLakj17+ plKlO+mgl7Vp84rT3ZCUtMUfsb2jooQdKGfgKg4/Ds+s9M9uVpeRhGX8bUxWAG/56p7SHdp ofw3zNLFd3t+NYDZP6uIEEGym0rBpXWtcdZ6W158B32/Vq3d7pCozCymLbP5yHqgacQz+KK 1MRM2ojeWZjntSYV4cCCg== X-UI-Out-Filterresults: notjunk:1; V01:K0:CbicoKfe+0Q=:hVHJFqN/cvZoqxvkgHhNVu VviFlMfybAvKBZibwm7PB8m9ZiyEVRG9d3LKCrjSqc2TJ3a5bFBKht9uq2CgHw6le0HguPQF8 ldWiKfq7/pKxpL9AaU10ToSsEAFOT2dzD8Xa2EIKgJ6zHHNQBlo+bBHr76+6GbZWd+OuQ1F9d 3l7t9seTqGp/91CVGPhLJsHYBLKIUe80SoP9i7LPhEBvcS2saN5ijAmZUljtnK4E0Kb4kkplY Mc/8HWp6CvD7C8NfV28dRHfRTvPlNNBL6maaf/niXBUJ7Eh6d+hT69FEEf2HHH7zEzWal9afp 8XAkH6SRBaMGj3NXxarCBP93kMMY5trLg8tiLC/YvMCXDvbqNtt9/U65tL9UteIqtXHtOM6Hk 1Uqllp/0hi2tC62iiy/4vNgP4fhDDyZ9QIYH7dsgpyHQXPfEFP8Ygxr7cvo1Q4YP5SbIx5hsl 9Vnfa3pM0isNRj12ExSb6r4jUHcwBbdZBbXqyqw/SMAiqkAPzgRWhm7CS3jHlEg+u+LjC9XIx df9/AmYrDV8jUCOXMVgRkHxxLzEDDdgIstmfqduYwnP0j0/rfEPY8G2IM7cuzm+Skij8grQDJ u1U9iH1a6csAwLaG1xsVvpg9D/kzEWXTIN0avU90yG7psLJqdpWz/KJANpPZ1n8sgh/++xqd4 eI56ogxNjL9ax1eqZfuGK7IC/uDXITwGZqRo+9xromVcnsUp00qh16sRp3VucR+Wi0FnmMkup kQTo5D7xaj3wXSCuIPoTLg5CaGe6Lb1KFsoAS8Hp96ADwhYfTbY8yNk+yInzh7NkWuv74dj9k TI/ew8OLKWFU8055vRP0PMvM96rGw== Cc: u-boot@lists.denx.de, Heinrich Schuchardt , Stefan Roese Subject: [U-Boot] [PATCH v2 1/1] dm: usb: ehci: avoid possible NULL dereference X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.18 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" Currently we check in ehci_shutdown() if ctrl is NULL after dereferencing it. Before this we have already dereferenced ctrl, ctrl->hccr, and ctrl->hcor in ehci_get_portsc_register(), ehci_submit_root(), and hci_common_init(). A better approach is to already check ctrl, ctrl->hccr, and ctrl->hcor during the initialization in ehci_register() and usb_lowlevel_init() and signal an error here via the return code. Signed-off-by: Heinrich Schuchardt --- v2 move the check to the initialization functions --- drivers/usb/host/ehci-hcd.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c index be3e842dcc..9437f7ecea 100644 --- a/drivers/usb/host/ehci-hcd.c +++ b/drivers/usb/host/ehci-hcd.c @@ -210,9 +210,6 @@ static int ehci_shutdown(struct ehci_ctrl *ctrl) uint32_t cmd, reg; int max_ports = HCS_N_PORTS(ehci_readl(&ctrl->hccr->cr_hcsparams)); - if (!ctrl || !ctrl->hcor) - return -EINVAL; - cmd = ehci_readl(&ctrl->hcor->or_usbcmd); /* If not run, directly return */ if (!(cmd & CMD_RUN)) @@ -1112,6 +1109,8 @@ int usb_lowlevel_init(int index, enum usb_init_type init, void **controller) rc = ehci_hcd_init(index, init, &ctrl->hccr, &ctrl->hcor); if (rc) return rc; + if (!ctrl->hccr || !ctrl->hcor) + return -1; if (init == USB_INIT_DEVICE) goto done; @@ -1613,10 +1612,13 @@ int ehci_register(struct udevice *dev, struct ehci_hccr *hccr, { struct usb_bus_priv *priv = dev_get_uclass_priv(dev); struct ehci_ctrl *ctrl = dev_get_priv(dev); - int ret; + int ret = -1; debug("%s: dev='%s', ctrl=%p, hccr=%p, hcor=%p, init=%d\n", __func__, dev->name, ctrl, hccr, hcor, init); + + if (!ctrl || !hccr || !hcor) + goto err; priv->desc_before_addr = true;