| Message ID | 1371208881-26916-1-git-send-email-thierry.reding@gmail.com |
|---|---|
| State | Not Applicable, archived |
| Headers | show |
On 06/14/2013 05:21 AM, Thierry Reding wrote: > Under some circumstances it happens that the connected PHY can't be > powered up properly, in which case the cleanup path currently crashes > because it checks the tegra->transceiver field using !IS_ERR(), which > will succeed because it is in fact NULL. Dereferencing that pointer > causes an oops in tegra_ehci_probe(). > > This patch fixes the issue by adding an additional label into the > cleanup path to separately take down the PHY and the transceiver. Reviewed-by: Stephen Warren <swarren@nvidia.com> -- To unsubscribe from this list: send the line "unsubscribe linux-tegra" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Fri, 14 Jun 2013, Thierry Reding wrote: > Under some circumstances it happens that the connected PHY can't be > powered up properly, in which case the cleanup path currently crashes > because it checks the tegra->transceiver field using !IS_ERR(), which > will succeed because it is in fact NULL. Dereferencing that pointer > causes an oops in tegra_ehci_probe(). > > This patch fixes the issue by adding an additional label into the > cleanup path to separately take down the PHY and the transceiver. > > Signed-off-by: Thierry Reding <thierry.reding@gmail.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> This looks a lot like a repeat of 369a9a9d2af7 (usb: host: ehci-tegra: Fix oops in error cleanup). Evidently someone wasn't very careful when changing the names of the statement labels. Or maybe a merge conflict was resolved incorrectly. Alan Stern -- To unsubscribe from this list: send the line "unsubscribe linux-tegra" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c index 8dac5e4..6ee7ef7 100644 --- a/drivers/usb/host/ehci-tegra.c +++ b/drivers/usb/host/ehci-tegra.c @@ -478,15 +478,15 @@ static int tegra_ehci_probe(struct platform_device *pdev) err = usb_add_hcd(hcd, irq, IRQF_SHARED); if (err) { dev_err(&pdev->dev, "Failed to add USB HCD\n"); - goto cleanup_phy; + goto cleanup_transceiver; } return err; -cleanup_phy: +cleanup_transceiver: if (!IS_ERR(tegra->transceiver)) otg_set_host(tegra->transceiver->otg, NULL); - +cleanup_phy: usb_phy_shutdown(hcd->phy); cleanup_clk_en: clk_disable_unprepare(tegra->clk);
Under some circumstances it happens that the connected PHY can't be powered up properly, in which case the cleanup path currently crashes because it checks the tegra->transceiver field using !IS_ERR(), which will succeed because it is in fact NULL. Dereferencing that pointer causes an oops in tegra_ehci_probe(). This patch fixes the issue by adding an additional label into the cleanup path to separately take down the PHY and the transceiver. Signed-off-by: Thierry Reding <thierry.reding@gmail.com> --- Note: This is based on top of Stephen's latest patch series to allow building the driver as a module: [PATCH V3 REPOST 0/7] USB: tegra: support building as a module drivers/usb/host/ehci-tegra.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)