USB: android: Create android_usb sysfs in android_probe() rather in init()
If the usb_composite_probe() function fails, then accessing of sysfs
entries which are created in init() may lead to NULL pointer dereference
crash.
So create the class and sysfs entries in device probe instead of
module_init to prevent accessing sysfs files when probe fails.
Change-Id: Ifc29c4c9608987d29f31313c67716cd0b79b6bf4
CRs-Fixed: 351959
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
diff --git a/drivers/usb/gadget/android.c b/drivers/usb/gadget/android.c
index 3fb9c83..fd119c6 100644
--- a/drivers/usb/gadget/android.c
+++ b/drivers/usb/gadget/android.c
@@ -1613,17 +1613,37 @@
dev->pdata = pdata;
+ android_class = class_create(THIS_MODULE, "android_usb");
+ if (IS_ERR(android_class))
+ return PTR_ERR(android_class);
+
+ ret = android_create_device(dev);
+ if (ret) {
+ pr_err("%s(): android_create_device failed\n", __func__);
+ goto err_dev;
+ }
+
ret = usb_composite_probe(&android_usb_driver, android_bind);
if (ret) {
pr_err("%s(): Failed to register android "
"composite driver\n", __func__);
+ goto err_probe;
}
return ret;
+err_probe:
+ android_destroy_device(dev);
+err_dev:
+ class_destroy(android_class);
+ return ret;
}
static int android_remove(struct platform_device *pdev)
{
+ struct android_dev *dev = _android_dev;
+
+ android_destroy_device(dev);
+ class_destroy(android_class);
usb_composite_unregister(&android_usb_driver);
return 0;
}
@@ -1639,15 +1659,10 @@
struct android_dev *dev;
int ret;
- android_class = class_create(THIS_MODULE, "android_usb");
- if (IS_ERR(android_class))
- return PTR_ERR(android_class);
-
dev = kzalloc(sizeof(*dev), GFP_KERNEL);
if (!dev) {
pr_err("%s(): Failed to alloc memory for android_dev\n",
__func__);
- class_destroy(android_class);
return -ENOMEM;
}
dev->functions = supported_functions;
@@ -1655,11 +1670,6 @@
INIT_WORK(&dev->work, android_work);
mutex_init(&dev->mutex);
- ret = android_create_device(dev);
- if (ret) {
- pr_err("%s(): android_create_device failed\n", __func__);
- goto err_dev;
- }
_android_dev = dev;
/* Override composite driver functions */
@@ -1670,26 +1680,17 @@
if (ret) {
pr_err("%s(): Failed to register android"
"platform driver\n", __func__);
- goto err_probe;
+ kfree(dev);
}
return ret;
-
-err_probe:
- android_destroy_device(dev);
-err_dev:
- kfree(dev);
- class_destroy(android_class);
- return ret;
}
module_init(init);
static void __exit cleanup(void)
{
platform_driver_unregister(&android_platform_driver);
- android_destroy_device(_android_dev);
kfree(_android_dev);
- class_destroy(android_class);
_android_dev = NULL;
}
module_exit(cleanup);