Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

usb: gadget: udc: amd5536udc_pci fix null-ptr-dereference

init_dma_pools() calls dma_pool_create(...dev->dev) to create dma pool.
however, dev->dev is actually set after calling init_dma_pools(), which
effectively makes dma_pool_create(..NULL) and cause crash.
To fix this issue, init dma only after dev->dev is set.

[ 1.317993] RIP: 0010:dma_pool_create+0x83/0x290
[ 1.323257] Call Trace:
[ 1.323390] ? pci_write_config_word+0x27/0x30
[ 1.323626] init_dma_pools+0x41/0x1a0 [snps_udc_core]
[ 1.323899] udc_pci_probe+0x202/0x2b1 [amd5536udc_pci]

Fixes: 7c51247a1f62 (usb: gadget: udc: Provide correct arguments for 'dma_pool_create')
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Link: https://lore.kernel.org/r/20210317230400.357756-1-ztong0001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Tong Zhang and committed by
Greg Kroah-Hartman
72035f49 b522f830

+5 -5
+5 -5
drivers/usb/gadget/udc/amd5536udc_pci.c
··· 153 153 pci_set_master(pdev); 154 154 pci_try_set_mwi(pdev); 155 155 156 + dev->phys_addr = resource; 157 + dev->irq = pdev->irq; 158 + dev->pdev = pdev; 159 + dev->dev = &pdev->dev; 160 + 156 161 /* init dma pools */ 157 162 if (use_dma) { 158 163 retval = init_dma_pools(dev); 159 164 if (retval != 0) 160 165 goto err_dma; 161 166 } 162 - 163 - dev->phys_addr = resource; 164 - dev->irq = pdev->irq; 165 - dev->pdev = pdev; 166 - dev->dev = &pdev->dev; 167 167 168 168 /* general probing */ 169 169 if (udc_probe(dev)) {