[PATCH] usb: musb: gadget: fix possible NULL pointer dereference

From: John Ogness
Date: Fri Feb 26 2016 - 09:52:40 EST

txstate() assumes that if the request buffer is mapped, a DMA channel
is allocated. There is a case here where the DMA channel is released
and then shortly thereafter (in general PIO code) the request buffer
is unmapped. However, in this case unmap_dma_buffer() silently fails
because the DMA channel is already gone. Thus, the next time txstate()
is called, there is a NULL pointer exception because the buffer is
mapped but no DMA channel is allocated.

This patch adds an extra call unmap_dma_buffer() before releasing the

Signed-off-by: John Ogness <john.ogness@xxxxxxxxxxxxx>
patch against next-20160226

drivers/usb/musb/musb_gadget.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 87bd578..c518d3c 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -393,6 +393,7 @@ static void txstate(struct musb *musb, struct musb_request *req)
request->dma + request->actual,
if (!use_dma) {
+ unmap_dma_buffer(req, musb);
musb_ep->dma = NULL;