bus: mhi: ep: Only send -ENOTCONN status if client driver is available

commit 58825582c12d3ca9ff52fe9c4aa143170113de94 upstream.

For the STOP and RESET commands, only send the channel disconnect status
-ENOTCONN if client driver is available. Otherwise, it will result in
null pointer dereference.

Cc: <stable@vger.kernel.org> # 5.19
Fixes: 509f399709b4 ("bus: mhi: ep: Add support for processing command rings")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
Link: https://lore.kernel.org/r/20221228161704.255268-4-manivannan.sadhasivam@linaro.org
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
index 1dc8a3557a46494f7d5e45509fc1be03abe52209..2b3a3b56e28079369d7e2da7725b917dd5e88609 100644 (file)
--- a/drivers/bus/mhi/ep/main.c
+++ b/drivers/bus/mhi/ep/main.c
@@ -196,9 +196,11 @@ static int mhi_ep_process_cmd_ring(struct mhi_ep_ring *ring, struct mhi_ring_ele
                mhi_ep_mmio_disable_chdb(mhi_cntrl, ch_id);
 
                /* Send channel disconnect status to client drivers */
-               result.transaction_status = -ENOTCONN;
-               result.bytes_xferd = 0;
-               mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result);
+               if (mhi_chan->xfer_cb) {
+                       result.transaction_status = -ENOTCONN;
+                       result.bytes_xferd = 0;
+                       mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result);
+               }
 
                /* Set channel state to STOP */
                mhi_chan->state = MHI_CH_STATE_STOP;
@@ -228,9 +230,11 @@ static int mhi_ep_process_cmd_ring(struct mhi_ep_ring *ring, struct mhi_ring_ele
                mhi_ep_ring_reset(mhi_cntrl, ch_ring);
 
                /* Send channel disconnect status to client driver */
-               result.transaction_status = -ENOTCONN;
-               result.bytes_xferd = 0;
-               mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result);
+               if (mhi_chan->xfer_cb) {
+                       result.transaction_status = -ENOTCONN;
+                       result.bytes_xferd = 0;
+                       mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result);
+               }
 
                /* Set channel state to DISABLED */
                mhi_chan->state = MHI_CH_STATE_DISABLED;