mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-13 20:16:26 +00:00
usb: gadget: lpc32xx_udc: don't dereference ep pointer before null check
[ Upstream commiteafa800416
] Currently pointer ep is being dereferenced before it is null checked leading to a null pointer dereference issue. Fix this by only assigning pointer udc once ep is known to be not null. Also remove a debug message that requires a valid udc which may not be possible at that point. Addresses-Coverity: ("Dereference before null check") Fixes:24a28e4283
("USB: gadget driver for LPC32xx") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Felipe Balbi <balbi@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
4a8c5f25c6
commit
51ad579d64
1 changed files with 6 additions and 5 deletions
|
@ -1614,17 +1614,17 @@ static int lpc32xx_ep_enable(struct usb_ep *_ep,
|
|||
const struct usb_endpoint_descriptor *desc)
|
||||
{
|
||||
struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep);
|
||||
struct lpc32xx_udc *udc = ep->udc;
|
||||
struct lpc32xx_udc *udc;
|
||||
u16 maxpacket;
|
||||
u32 tmp;
|
||||
unsigned long flags;
|
||||
|
||||
/* Verify EP data */
|
||||
if ((!_ep) || (!ep) || (!desc) ||
|
||||
(desc->bDescriptorType != USB_DT_ENDPOINT)) {
|
||||
dev_dbg(udc->dev, "bad ep or descriptor\n");
|
||||
(desc->bDescriptorType != USB_DT_ENDPOINT))
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
udc = ep->udc;
|
||||
maxpacket = usb_endpoint_maxp(desc);
|
||||
if ((maxpacket == 0) || (maxpacket > ep->maxpacket)) {
|
||||
dev_dbg(udc->dev, "bad ep descriptor's packet size\n");
|
||||
|
@ -1872,7 +1872,7 @@ static int lpc32xx_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
|
|||
static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value)
|
||||
{
|
||||
struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep);
|
||||
struct lpc32xx_udc *udc = ep->udc;
|
||||
struct lpc32xx_udc *udc;
|
||||
unsigned long flags;
|
||||
|
||||
if ((!ep) || (ep->hwep_num <= 1))
|
||||
|
@ -1882,6 +1882,7 @@ static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value)
|
|||
if (ep->is_in)
|
||||
return -EAGAIN;
|
||||
|
||||
udc = ep->udc;
|
||||
spin_lock_irqsave(&udc->lock, flags);
|
||||
|
||||
if (value == 1) {
|
||||
|
|
Loading…
Reference in a new issue