usb: gadget: mv_u3d: request_irq() after initializing UDC

If IRQ occurs between calling  request_irq() and  mv_u3d_eps_init(),
then null pointer dereference occurs since u3d->eps[] wasn't
initialized yet but used in mv_u3d_nuke().

The patch puts registration of the interrupt handler after
initializing of neccesery data.

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: 90fccb529d24 ("usb: gadget: Gadget directory cleanup - group UDC drivers")
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Link: https://lore.kernel.org/r/20210818141247.4794-1-lutovinova@ispras.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/gadget/udc/mv_u3d_core.c b/drivers/usb/gadget/udc/mv_u3d_core.c
index ce3d7a3..a1057dd 100644 (file)
--- a/drivers/usb/gadget/udc/mv_u3d_core.c
+++ b/drivers/usb/gadget/udc/mv_u3d_core.c
@@ -1921,14 +1921,6 @@ static int mv_u3d_probe(struct platform_device *dev)
                goto err_get_irq;
        }
        u3d->irq = r->start;
-       if (request_irq(u3d->irq, mv_u3d_irq,
-               IRQF_SHARED, driver_name, u3d)) {
-               u3d->irq = 0;
-               dev_err(&dev->dev, "Request irq %d for u3d failed\n",
-                       u3d->irq);
-               retval = -ENODEV;
-               goto err_request_irq;
-       }
 
        /* initialize gadget structure */
        u3d->gadget.ops = &mv_u3d_ops;  /* usb_gadget_ops */
@@ -1941,6 +1933,15 @@ static int mv_u3d_probe(struct platform_device *dev)
 
        mv_u3d_eps_init(u3d);
 
+       if (request_irq(u3d->irq, mv_u3d_irq,
+               IRQF_SHARED, driver_name, u3d)) {
+               u3d->irq = 0;
+               dev_err(&dev->dev, "Request irq %d for u3d failed\n",
+                       u3d->irq);
+               retval = -ENODEV;
+               goto err_request_irq;
+       }
+
        /* external vbus detection */
        if (u3d->vbus) {
                u3d->clock_gating = 1;
@@ -1964,8 +1965,8 @@ static int mv_u3d_probe(struct platform_device *dev)
 
 err_unregister:
        free_irq(u3d->irq, u3d);
-err_request_irq:
 err_get_irq:
+err_request_irq:
        kfree(u3d->status_req);
 err_alloc_status_req:
        kfree(u3d->eps);