From: Andrzej Pietrasiewicz Date: Fri, 13 Dec 2013 13:46:40 +0000 (+0100) Subject: usb: gadget: nokia: fix error recovery path for optional functions X-Git-Tag: v3.14-rc1~148^2~90^2~45 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=45ab460975c5433d1bd81b211fe643732abaae19;p=kernel%2Fkernel-generic.git usb: gadget: nokia: fix error recovery path for optional functions In the nokia gadget some USB functions (obex 1 and 2, phonet) are optional. If at the start of nokia_bind_config e.g. fi_phonet is an error pointer, which can happen because we don't fail the bind process if usb_get_function_instance() fails for fi_phonet, then f_phonet is NULL, and phonet_stat = usb_add_function(c, f_phonet); is never called and phonet_stat remains 0. If, in these circumstances, we hit the err_conf label then !phonet_stat evaluates to true and we try usb_remove_function() with its second parameter being f_phonet which is NULL and it causes NULL pointer dereference. This patch changes the initial values of (obex1|obex2|phonet)_stat to a nonzero value so that if the err_conf label is hit while the respective functions have not been acquired the usb_remove_function() is not called for those functions. Signed-off-by: Andrzej Pietrasiewicz Signed-off-by: Felipe Balbi --- diff --git a/drivers/usb/gadget/nokia.c b/drivers/usb/gadget/nokia.c index 0a8099a..3ab3861 100644 --- a/drivers/usb/gadget/nokia.c +++ b/drivers/usb/gadget/nokia.c @@ -126,9 +126,9 @@ static int __init nokia_bind_config(struct usb_configuration *c) struct usb_function *f_ecm; struct usb_function *f_obex2 = NULL; int status = 0; - int obex1_stat = 0; - int obex2_stat = 0; - int phonet_stat = 0; + int obex1_stat = -1; + int obex2_stat = -1; + int phonet_stat = -1; if (!IS_ERR(fi_phonet)) { f_phonet = usb_get_function(fi_phonet);