Macpaul Lin b9d91fa921 usb: mtu3: fix panic in mtu3_gadget_stop() ... commit 20914919ad upstream. This patch fixes a possible issue when mtu3_gadget_stop() already assigned NULL to mtu->gadget_driver during mtu_gadget_disconnect(). [<ffffff9008161974>] notifier_call_chain+0xa4/0x128 [<ffffff9008161fd4>] __atomic_notifier_call_chain+0x84/0x138 [<ffffff9008162ec0>] notify_die+0xb0/0x120 [<ffffff900809e340>] die+0x1f8/0x5d0 [<ffffff90080d03b4>] __do_kernel_fault+0x19c/0x280 [<ffffff90080d04dc>] do_bad_area+0x44/0x140 [<ffffff90080d0f9c>] do_translation_fault+0x4c/0x90 [<ffffff9008080a78>] do_mem_abort+0xb8/0x258 [<ffffff90080849d0>] el1_da+0x24/0x3c [<ffffff9009bde01c>] mtu3_gadget_disconnect+0xac/0x128 [<ffffff9009bd576c>] mtu3_irq+0x34c/0xc18 [<ffffff90082ac03c>] __handle_irq_event_percpu+0x2ac/0xcd0 [<ffffff90082acae0>] handle_irq_event_percpu+0x80/0x138 [<ffffff90082acc44>] handle_irq_event+0xac/0x148 [<ffffff90082b71cc>] handle_fasteoi_irq+0x234/0x568 [<ffffff90082a8708>] generic_handle_irq+0x48/0x68 [<ffffff90082a96ac>] __handle_domain_irq+0x264/0x1740 [<ffffff90080819f4>] gic_handle_irq+0x14c/0x250 [<ffffff9008084cec>] el1_irq+0xec/0x194 [<ffffff90085b985c>] dma_pool_alloc+0x6e4/0xae0 [<ffffff9008d7f890>] cmdq_mbox_pool_alloc_impl+0xb0/0x238 [<ffffff9008d80904>] cmdq_pkt_alloc_buf+0x2dc/0x7c0 [<ffffff9008d80f60>] cmdq_pkt_add_cmd_buffer+0x178/0x270 [<ffffff9008d82320>] cmdq_pkt_perf_begin+0x108/0x148 [<ffffff9008d824d8>] cmdq_pkt_create+0x178/0x1f0 [<ffffff9008f96230>] mtk_crtc_config_default_path+0x328/0x7a0 [<ffffff90090246cc>] mtk_drm_idlemgr_kick+0xa6c/0x1460 [<ffffff9008f9bbb4>] mtk_drm_crtc_atomic_begin+0x1a4/0x1a68 [<ffffff9008e8df9c>] drm_atomic_helper_commit_planes+0x154/0x878 [<ffffff9008f2fb70>] mtk_atomic_complete.isra.16+0xe80/0x19c8 [<ffffff9008f30910>] mtk_atomic_commit+0x258/0x898 [<ffffff9008ef142c>] drm_atomic_commit+0xcc/0x108 [<ffffff9008ef7cf0>] drm_mode_atomic_ioctl+0x1c20/0x2580 [<ffffff9008ebc768>] drm_ioctl_kernel+0x118/0x1b0 [<ffffff9008ebcde8>] drm_ioctl+0x5c0/0x920 [<ffffff900863b030>] do_vfs_ioctl+0x188/0x1820 [<ffffff900863c754>] SyS_ioctl+0x8c/0xa0 Fixes: df2069acb0 ("usb: Add MediaTek USB3 DRD driver") Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com> Acked-by: Chunfeng Yun <chunfeng.yun@mediatek.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/1604642069-20961-1-git-send-email-macpaul.lin@mediatek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-11-10 12:37:33 +01:00
..
atm	USB: atm: ueagle-atm: add missing endpoint check	2019-12-17 19:55:44 +01:00
c67x00	USB: c67x00: fix use after free in c67x00_giveback_urb	2020-07-22 09:33:09 +02:00
cdns3	usb: cdns3: gadget: suspicious implicit sign extension	2020-11-10 12:37:31 +01:00
chipidea	usb: chipidea: core: add wakeup support for extcon	2020-07-22 09:33:10 +02:00
class	usb: cdc-acm: fix cooldown mechanism	2020-11-05 11:43:28 +01:00
common	usb: common: usb-conn-gpio: Don't log an error on probe deferral	2019-12-17 19:55:39 +01:00
core	USB: Add NO_LPM quirk for Kingston flash drive	2020-11-10 12:37:33 +01:00
dwc2	usb: dwc2: Fix INTR OUT transfers in DDMA mode.	2020-10-29 09:57:44 +01:00
dwc3	usb: dwc3: ep0: Fix delay status handling	2020-11-10 12:37:33 +01:00
early	USB: early: Handle AMD's spec-compliant identifiers, too	2020-04-29 16:33:13 +02:00
gadget	usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets.	2020-10-29 09:58:11 +01:00
host	usb: host: fsl-mph-dr-of: check return of dma_set_mask()	2020-11-05 11:43:29 +01:00
image	USB: microtek: fix info-leak at probe	2019-10-04 11:02:58 +02:00
isp1760	usb: add a HCD_DMA flag instead of guestimating DMA capabilities	2019-08-21 10:03:35 -07:00
misc	USB: adutux: fix debugging	2020-11-05 11:43:17 +01:00
mon	usb: mon: Fix a deadlock in usbmon between mmap and read	2019-12-17 19:55:49 +01:00
mtu3	usb: mtu3: fix panic in mtu3_gadget_stop()	2020-11-10 12:37:33 +01:00
musb	usb: musb: Fix runtime PM imbalance on error	2020-06-10 20:24:56 +02:00
phy	usb: phy: twl6030-usb: Fix a resource leak in an error handling path in 'twl6030_usb_probe()'	2020-06-03 08:21:12 +02:00
renesas_usbhs	usb: renesas_usbhs: getting residue from callback_result	2020-06-30 15:37:00 -04:00
roles	usb: roles: fix a potential use after free	2019-12-17 19:55:46 +01:00
serial	USB: serial: option: add Telit FN980 composition 0x1055	2020-11-10 12:37:33 +01:00
storage	USB: UAS: fix disconnect by unplugging a hub	2020-09-23 12:40:43 +02:00
typec	usb: typec: tcpm: reset hard_reset_count for any disconnect	2020-11-05 11:43:28 +01:00
usbip	usbip: Fix error path of vhci_recv_ret_submit()	2019-12-31 16:46:05 +01:00
Kconfig	usb: common: create Kconfig file	2019-09-03 19:00:39 +02:00
Makefile	USB: Changes for v5.4 merge window	2019-09-02 19:20:57 +02:00
usb-skeleton.c	USB: usb-skeleton: drop redundant in-urb check	2019-10-10 12:41:19 +02:00