usb: gadget: mv_u3d: request_irq() after initializing UDC
authorNadezda Lutovinova <lutovinova@ispras.ru>
Wed, 18 Aug 2021 14:12:47 +0000 (17:12 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 15 Sep 2021 07:50:42 +0000 (09:50 +0200)
commita9c29bc2a5780a6389c501d42b70a67d1b1818fc
treec7fb82191b64ddfc98516be20aa04a9ee5c2537d
parentb2f4dd13b211691715e99e28fff9ce9557acc57c
usb: gadget: mv_u3d: request_irq() after initializing UDC

[ Upstream commit 2af0c5ffadaf9d13eca28409d4238b4e672942d3 ]

If IRQ occurs between calling  request_irq() and  mv_u3d_eps_init(),
then null pointer dereference occurs since u3d->eps[] wasn't
initialized yet but used in mv_u3d_nuke().

The patch puts registration of the interrupt handler after
initializing of neccesery data.

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: 90fccb529d24 ("usb: gadget: Gadget directory cleanup - group UDC drivers")
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Link: https://lore.kernel.org/r/20210818141247.4794-1-lutovinova@ispras.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/usb/gadget/udc/mv_u3d_core.c