Felipe Balbi 42a1d0367d usb: gadget: udc: core: fix kernel oops with soft-connect ... [ Upstream commit bfa6b18c68 ] Currently, there's no guarantee that udc->driver will be valid when using soft_connect sysfs interface. In fact, we can very easily trigger a NULL pointer dereference by trying to disconnect when a gadget driver isn't loaded. Fix this bug: ~# echo disconnect > soft_connect [ 33.685743] Unable to handle kernel NULL pointer dereference at virtual address 00000014 [ 33.694221] pgd = ed0cc000 [ 33.697174] [00000014] *pgd=ae351831, *pte=00000000, *ppte=00000000 [ 33.703766] Internal error: Oops: 17 [#1] SMP ARM [ 33.708697] Modules linked in: xhci_plat_hcd xhci_hcd snd_soc_davinci_mcasp snd_soc_tlv320aic3x snd_soc_edma snd_soc_omap snd_soc_evm snd_soc_core dwc3 snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd lis3lv02d_i2c matrix_keypad lis3lv02d dwc3_omap input_polldev soundcore [ 33.734372] CPU: 0 PID: 1457 Comm: bash Not tainted 3.17.0-09740-ga93416e-dirty #345 [ 33.742457] task: ee71ce00 ti: ee68a000 task.ti: ee68a000 [ 33.748116] PC is at usb_udc_softconn_store+0xa4/0xec [ 33.753416] LR is at mark_held_locks+0x78/0x90 [ 33.758057] pc : [<c04df128>] lr : [<c00896a4>] psr: 20000013 [ 33.758057] sp : ee68bec8 ip : c0c00008 fp : ee68bee4 [ 33.770050] r10: ee6b394c r9 : ee68bf80 r8 : ee6062c0 [ 33.775508] r7 : 00000000 r6 : ee6062c0 r5 : 0000000b r4 : ee739408 [ 33.782346] r3 : 00000000 r2 : 00000000 r1 : ee71d390 r0 : ee664170 [ 33.789168] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user [ 33.796636] Control: 10c5387d Table: ad0cc059 DAC: 00000015 [ 33.802638] Process bash (pid: 1457, stack limit = 0xee68a248) [ 33.808740] Stack: (0xee68bec8 to 0xee68c000) [ 33.813299] bec0: 0000000b c0411284 ee6062c0 00000000 ee68bef4 ee68bee8 [ 33.821862] bee0: c04112ac c04df090 ee68bf14 ee68bef8 c01c2868 c0411290 0000000b ee6b3940 [ 33.830419] bf00: 00000000 00000000 ee68bf4c ee68bf18 c01c1a24 c01c2818 00000000 00000000 [ 33.838990] bf20: ee61b940 ee2f47c0 0000000b 000ce408 ee68bf80 c000f304 ee68a000 00000000 [ 33.847544] bf40: ee68bf7c ee68bf50 c0152dd8 c01c1960 ee68bf7c c0170af8 ee68bf7c ee2f47c0 [ 33.856099] bf60: ee2f47c0 000ce408 0000000b c000f304 ee68bfa4 ee68bf80 c0153330 c0152d34 [ 33.864653] bf80: 00000000 00000000 0000000b 000ce408 b6e7fb50 00000004 00000000 ee68bfa8 [ 33.873204] bfa0: c000f080 c01532e8 0000000b 000ce408 00000001 000ce408 0000000b 00000000 [ 33.881763] bfc0: 0000000b 000ce408 b6e7fb50 00000004 0000000b 00000000 000c5758 00000000 [ 33.890319] bfe0: 00000000 bec2c924 b6de422d b6e1d226 40000030 00000001 75716d2f 00657565 [ 33.898890] [<c04df128>] (usb_udc_softconn_store) from [<c04112ac>] (dev_attr_store+0x28/0x34) [ 33.907920] [<c04112ac>] (dev_attr_store) from [<c01c2868>] (sysfs_kf_write+0x5c/0x60) [ 33.916200] [<c01c2868>] (sysfs_kf_write) from [<c01c1a24>] (kernfs_fop_write+0xd0/0x194) [ 33.924773] [<c01c1a24>] (kernfs_fop_write) from [<c0152dd8>] (vfs_write+0xb0/0x1bc) [ 33.932874] [<c0152dd8>] (vfs_write) from [<c0153330>] (SyS_write+0x54/0xb0) [ 33.940247] [<c0153330>] (SyS_write) from [<c000f080>] (ret_fast_syscall+0x0/0x48) [ 33.948160] Code: e1a01007 e12fff33 e5140004 e5143008 (e5933014) [ 33.954625] ---[ end trace f849bead94eab7ea ]--- Fixes: 2ccea03 (usb: gadget: introduce UDC Class) Signed-off-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2014-11-14 08:48:00 -08:00
..
accessibility
acpi	ACPICA: Update to GPIO region handler interface.	2014-10-05 14:54:11 -07:00
amba
ata	libata-sff: Fix controllers with no ctl port	2014-11-14 08:47:53 -08:00
atm	atm: idt77252: fix dev refcnt leak	2013-12-08 07:29:25 -08:00
auxdisplay
base	firmware_class: make sure fw requests contain a name	2014-10-30 09:35:10 -07:00
bcma
block	drbd: compute the end before rb_insert_augmented()	2014-11-14 08:47:55 -08:00
bluetooth	Bluetooth: Fix issue with USB suspend in btusb driver	2014-10-30 09:35:12 -07:00
bus	bus: mvebu-mbus: allow several windows with the same target/attribute	2014-06-07 13:25:37 -07:00
cdrom	drivers/cdrom/cdrom.c: use kzalloc() for failing hardware	2013-07-13 11:42:26 -07:00
char	random: add and use memzero_explicit() for clearing data	2014-11-14 08:47:55 -08:00
clk	clk: spear3xx: Use proper control register offset	2014-07-17 15:58:02 -07:00
clocksource	clocksource: Exynos_mct: Register clock event after request_irq()	2014-06-07 13:25:29 -07:00
connector	net: Use netlink_ns_capable to verify the permisions of netlink messages	2014-06-26 15:12:37 -04:00
cpufreq	cpufreq: intel_pstate: Fix setting max_perf_pct in performance policy	2014-11-14 08:47:58 -08:00
cpuidle	cpuidle: Check the result of cpuidle_get_driver() against NULL	2014-04-14 06:42:15 -07:00
crypto	crypto: ux500 - make interrupt mode plausible	2014-09-05 16:28:35 -07:00
dca
devfreq
dio
dma	ioat: fix tasklet tear down	2014-03-06 21:30:14 -08:00
edac	cpc925_edac: Report UE events properly	2014-11-14 08:48:00 -08:00
eisa	Revert "EISA: Initialize device before its resources"	2014-02-13 13:47:59 -08:00
extcon	extcon: max77693: Fix two NULL pointer exceptions on missing pdata	2014-07-06 18:54:15 -07:00
firewire	firewire: ohci: fix probe failure with Agere/LSI controllers	2014-05-30 21:52:11 -07:00
firmware	firmware: Do not use WARN_ON(!spin_is_locked())	2014-09-17 09:03:57 -07:00
gpio	gpio: mxs: Allow for recursive enable_irq_wake() call	2014-05-13 13:59:45 +02:00
gpu	drm/nouveau/bios: memset dcb struct to zero before parsing	2014-11-14 08:47:56 -08:00
hid	HID: logitech-dj: prevent false errors to be shown	2014-10-05 14:54:08 -07:00
hsi
hv	Drivers: hv: vmbus: Fix a bug in vmbus_open()	2014-10-30 09:35:11 -07:00
hwmon	hwmon: (dme1737) Prevent overflow problem when writing large limits	2014-09-05 16:28:35 -07:00
hwspinlock
i2c	i2c: at91: Fix a race condition during signal handling in at91_do_twi_xfer.	2014-10-05 14:54:07 -07:00
ide
idle	x86 idle: Repair large-server 50-watt idle-power regression	2014-01-09 12:24:21 -08:00
iio	iio:inkern: fix overwritten -EPROBE_DEFER in of_iio_channel_get_by_name	2014-10-05 14:54:12 -07:00
infiniband	Target/iser: Don't put isert_conn inside disconnected handler	2014-10-05 14:54:12 -07:00
input	Input: i8042 - quirks for Fujitsu Lifebook A544 and Lifebook AH544	2014-11-14 08:47:56 -08:00
iommu	iommu/amd: Fix cleanup_domain for mass device removal	2014-09-17 09:03:57 -07:00
ipack
irqchip	irqchip: gic: Fix core ID calculation when topology is read from DT	2014-07-28 08:00:06 -07:00
isdn	isdnloop: several buffer overflows	2014-04-14 06:42:18 -07:00
leds	leds: leds-pwm: properly clean up after probe failure	2014-06-07 13:25:34 -07:00
lguest	x86, flags: Rename X86_EFLAGS_BIT1 to X86_EFLAGS_FIXED	2014-11-14 08:47:54 -08:00
macintosh	powerpc/windfarm: Fix noisy slots-fan on Xserve (rm31)	2013-08-11 18:35:20 -07:00
mailbox
md	dm log userspace: fix memory leak in dm_ulog_tfr_init failure path	2014-11-14 08:47:55 -08:00
media	media: tda7432: Fix setting TDA7432_MUTE bit for TDA7432_RF register	2014-11-14 08:47:56 -08:00
memory
memstick
message	mptfusion: enable no_write_same for vmware scsi disks	2014-10-30 09:35:10 -07:00
mfd	mfd: rtsx_pcr: Fix MSI enable error handling	2014-11-14 08:47:55 -08:00
misc	mei: nfc: fix memory leak in error path	2014-09-05 16:28:36 -07:00
mmc	mmc: rtsx_pci_sdmmc: fix incorrect last byte in R2 response	2014-11-14 08:47:53 -08:00
mtd	UBI: add missing kmem_cache_free() in process_pool_aeb error path	2014-11-14 08:47:55 -08:00
net	wireless: rt2x00: add new rt2800usb device	2014-11-14 08:47:59 -08:00
nfc	NFC: microread: Potential overflows in microread_target_discovered()	2014-10-05 14:54:12 -07:00
ntb	NTB: Correct debugfs to work with more than 1 NTB Device	2013-11-13 12:05:35 +09:00
nubus
of	of: fix PCI bus match for PCIe slots	2014-02-22 12:41:27 -08:00
oprofile
parisc	parisc: Fix interrupt routing for C8000 serial ports	2013-08-11 18:35:21 -07:00
parport	parport: parport_pc: remove double PCI ID for NetMos	2014-02-06 11:08:15 -08:00
pci	PCI: Generate uppercase hex for modalias interface class	2014-10-30 09:35:12 -07:00
pcmcia	pcmcia: at91_cf: fix gpio_get_value in at91_cf_get_status	2013-07-21 18:21:25 -07:00
pinctrl	pinctrl: protect pinctrl_list add	2014-02-20 11:06:11 -08:00
platform	hp_accel: Add a new PnP ID HPQ6007 for new HP laptops	2014-02-06 11:08:16 -08:00
pnp	PNP / ACPI: proper handling of ACPI IO/Memory resource parsing failures	2014-03-23 21:38:22 -07:00
power	power: max17040: Fix NULL pointer dereference when there is no platform_data	2014-02-22 12:41:29 -08:00
pps
ps3
ptp
pwm
rapidio	rapidio/tsi721_dma: fix failure to obtain transaction descriptor	2014-08-07 14:30:25 -07:00
regulator	regulator: arizona-ldo1: remove bypass functionality	2014-09-17 09:03:57 -07:00
remoteproc
reset
rpmsg
rtc	rtc: rtc-at91rm9200: fix infinite wait for ACKUPD irq	2014-06-26 15:12:37 -04:00
s390	s390/chsc: fix SEI usage on old FW levels	2014-05-13 13:59:42 +02:00
sbus	bbc-i2c: Fix BBC I2C envctrl on SunBlade 2000	2014-08-14 09:24:16 +08:00
scsi	qla_target: don't delete changed nacls	2014-11-14 08:47:57 -08:00
sfi
sh
sn
spi	spi: pxa2xx: toggle clocks on suspend if not disabled by runtime PM	2014-11-14 08:47:59 -08:00
ssb
ssbi
staging	staging:iio:ade7758: Remove "raw" from channel name	2014-11-14 08:47:58 -08:00
target	target: Fix APTPL metadata handling for dynamic MappedLUNs	2014-11-14 08:47:57 -08:00
tc
thermal
tty	tty: Fix high cpu load if tty is unreleaseable	2014-11-14 08:48:00 -08:00
uio	Fix a few incorrectly checked [io_]remap_pfn_range() calls	2013-11-13 12:05:33 +09:00
usb	usb: gadget: udc: core: fix kernel oops with soft-connect	2014-11-14 08:48:00 -08:00
uwb
vfio	mm: close PageTail race	2014-04-03 12:01:05 -07:00
vhost	vhost: validate vhost_get_vq_desc return value	2014-04-14 06:42:18 -07:00
video	framebuffer: fix border color	2014-11-14 08:47:56 -08:00
virt
virtio	virtio_pci: fix virtio spec compliance on restore	2014-11-14 08:47:55 -08:00
vlynq
vme	VME: Correct read/write alignment algorithm	2014-02-22 12:41:28 -08:00
w1	w1: fix w1_send_slave dropping a slave id	2014-05-06 07:55:28 -07:00
watchdog	watchdog: ath79_wdt: avoid spurious restarts on AR934x	2014-07-06 18:54:14 -07:00
xen	xen/gnttab: leave lazy MMU mode in the case of a m2p override failure	2013-12-11 22:36:27 -08:00
zorro
Kconfig
Makefile