summaryrefslogtreecommitdiff
path: root/drivers/usb
diff options
context:
space:
mode:
authorYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>2015-01-30 15:58:23 +0900
committerFelipe Balbi <balbi@ti.com>2015-01-30 10:35:37 -0600
commitffb9da65755815611010e07ad1c937858f226cb2 (patch)
tree45e5c58be6ab7fe6965e700fae0a556b33e30f9d /drivers/usb
parent0f4ff5f1f95796ff5e32766136f3d3dfce1ec2d7 (diff)
usb: renesas_usbhs: fix NULL pointer dereference in dma_release_channel()
This patch fixes an issue that the following commit causes NULL pointer dereference in dma_release_channel(). "usb: renesas_usbhs: add support for requesting DT DMA" (commit id abd2dbf6bb1b5f3a03a8c76b1a8879da1dd30caa) The usbhsf_dma_init_dt() should set fifo->{t,r}x_chan to NULL if dma_request_slave_channel_reason() returns IS_ERR value. Otherwise, usbhsf_dma_quit() will call dma_release_channel(), and then NULL pointer dereference happens. Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Tested-by: Simon Horman <horms+renesas@verge.net.au> Reported-by: Simon Horman <horms@verge.net.au> Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
Diffstat (limited to 'drivers/usb')
-rw-r--r--drivers/usb/renesas_usbhs/fifo.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index 4c086b1cda04..d891bff39d66 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -1072,7 +1072,11 @@ static void usbhsf_dma_init_pdev(struct usbhs_fifo *fifo)
static void usbhsf_dma_init_dt(struct device *dev, struct usbhs_fifo *fifo)
{
fifo->tx_chan = dma_request_slave_channel_reason(dev, "tx");
+ if (IS_ERR(fifo->tx_chan))
+ fifo->tx_chan = NULL;
fifo->rx_chan = dma_request_slave_channel_reason(dev, "rx");
+ if (IS_ERR(fifo->rx_chan))
+ fifo->rx_chan = NULL;
}
static void usbhsf_dma_init(struct usbhs_priv *priv,