--- /dev/null
+From 5f5610f69be3a925b1f79af27150bb7377bc9ad6 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 30 Jul 2013 15:18:15 -0400
+Subject: usb: gadget: fix a bug and a WARN_ON in dummy-hcd
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 5f5610f69be3a925b1f79af27150bb7377bc9ad6 upstream.
+
+This patch fixes a NULL pointer dereference and a WARN_ON in
+dummy-hcd. These things were the result of moving to the UDC core
+framework, and possibly of changes to that framework.
+
+Now unloading a gadget driver causes the UDC to be stopped after the
+gadget driver is unbound, not before. Therefore the "driver" argument
+to dummy_udc_stop() can be NULL, so we must not try to print the
+driver's name without checking first.
+
+Also, the UDC framework automatically unregisters the gadget when the
+UDC is deleted. Therefore a sysfs attribute file attached to the
+gadget must be removed before the UDC is deleted, not after.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/dummy_hcd.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/gadget/dummy_hcd.c
++++ b/drivers/usb/gadget/dummy_hcd.c
+@@ -923,8 +923,9 @@ static int dummy_udc_stop(struct usb_gad
+ struct dummy_hcd *dum_hcd = gadget_to_dummy_hcd(g);
+ struct dummy *dum = dum_hcd->dum;
+
+- dev_dbg(udc_dev(dum), "unregister gadget driver '%s'\n",
+- driver->driver.name);
++ if (driver)
++ dev_dbg(udc_dev(dum), "unregister gadget driver '%s'\n",
++ driver->driver.name);
+
+ dum->driver = NULL;
+
+@@ -1000,8 +1001,8 @@ static int dummy_udc_remove(struct platf
+ {
+ struct dummy *dum = platform_get_drvdata(pdev);
+
+- usb_del_gadget_udc(&dum->gadget);
+ device_remove_file(&dum->gadget.dev, &dev_attr_function);
++ usb_del_gadget_udc(&dum->gadget);
+ return 0;
+ }
+