dm: usb: ehci: avoid possible NULL dereference

Currently we check in ehci_shutdown() if ctrl is NULL after
dereferencing it.

Before this we have already dereferenced ctrl, ctrl->hccr,
and ctrl->hcor in ehci_get_portsc_register(), ehci_submit_root(),
and hci_common_init().

A better approach is to already check ctrl, ctrl->hccr, and ctrl->hcor
during the initialization in ehci_register() and usb_lowlevel_init()
and signal an error here via the return code.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>

diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index be3e842dcc30fddb2af2f47094f6fa0cd8ab1966..80cc87c9ef739fbf81c7c4cef5823f1e65f130c0 100644 (file)
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -210,9 +210,6 @@ static int ehci_shutdown(struct ehci_ctrl *ctrl)
        uint32_t cmd, reg;
        int max_ports = HCS_N_PORTS(ehci_readl(&ctrl->hccr->cr_hcsparams));
 
-       if (!ctrl || !ctrl->hcor)
-               return -EINVAL;
-
        cmd = ehci_readl(&ctrl->hcor->or_usbcmd);
        /* If not run, directly return */
        if (!(cmd & CMD_RUN))
@@ -1112,6 +1109,8 @@ int usb_lowlevel_init(int index, enum usb_init_type init, void **controller)
        rc = ehci_hcd_init(index, init, &ctrl->hccr, &ctrl->hcor);
        if (rc)
                return rc;
+       if (!ctrl->hccr || !ctrl->hcor)
+               return -1;
        if (init == USB_INIT_DEVICE)
                goto done;
 
@@ -1613,11 +1612,14 @@ int ehci_register(struct udevice *dev, struct ehci_hccr *hccr,
 {
        struct usb_bus_priv *priv = dev_get_uclass_priv(dev);
        struct ehci_ctrl *ctrl = dev_get_priv(dev);
-       int ret;
+       int ret = -1;
 
        debug("%s: dev='%s', ctrl=%p, hccr=%p, hcor=%p, init=%d\n", __func__,
              dev->name, ctrl, hccr, hcor, init);
 
+       if (!ctrl || !hccr || !hcor)
+               goto err;
+
        priv->desc_before_addr = true;
 
        ehci_setup_ops(ctrl, ops);