From e4b9a52fdf23d72b136276ee6867d810d1498864 Mon Sep 17 00:00:00 2001 From: Mayank Rana Date: Tue, 31 Mar 2020 14:51:09 -0700 Subject: [PATCH] usb: gadget: qdss: Add NULL check against priv_usb with usb_qdss_close() In some cases, it has been observed that Coresight QDSS driver is not callig usb_qdss_open() API before calling usb_qdss_close() API. This results into NULL pointer dereference related crash within usb_qdss_close() API as per channel based priv_usb is not being initialized (it is happening with usb_qdss_open() context). Hence add explicit check aginst NULL before using ch->priv_usb instead of depending on client driver. Change-Id: Ib5073d9262a06c0101d14a23dd6a2fdb77861ff3 Signed-off-by: Mayank Rana --- drivers/usb/gadget/function/f_qdss.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_qdss.c b/drivers/usb/gadget/function/f_qdss.c index ae0180b6e6f8..0a9d15216f01 100644 --- a/drivers/usb/gadget/function/f_qdss.c +++ b/drivers/usb/gadget/function/f_qdss.c @@ -1001,7 +1001,7 @@ EXPORT_SYMBOL(usb_qdss_open); void usb_qdss_close(struct usb_qdss_ch *ch) { - struct f_qdss *qdss = ch->priv_usb; + struct f_qdss *qdss; struct usb_gadget *gadget; unsigned long flags; int status; @@ -1009,6 +1009,14 @@ void usb_qdss_close(struct usb_qdss_ch *ch) pr_debug("%s\n", __func__); spin_lock_irqsave(&qdss_lock, flags); + if (!ch->priv_usb) { + spin_unlock_irqrestore(&qdss_lock, flags); + pr_err("%s is called for %s without calling usb_qdss_open()\n", + __func__, ch->name); + return; + } + + qdss = ch->priv_usb; ch->priv_usb = NULL; if (!qdss || !qdss->usb_connected || !strcmp(qdss->ch.name, USB_QDSS_CH_MDM)) {