hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

usb: gadget: lpc32xx_udc: don't dereference ep pointer before null check 

Currently pointer ep is being dereferenced before it is null checked
leading to a null pointer dereference issue.  Fix this by only assigning
pointer udc once ep is known to be not null.  Also remove a debug
message that requires a valid udc which may not be possible at that
point.

Addresses-Coverity: ("Dereference before null check")
Fixes: 24a28e4283 ("USB: gadget driver for LPC32xx")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
This commit is contained in:
Colin Ian King 2020-05-21 16:13:00 +01:00 committed by Felipe Balbi
parent 1c0e69ae1b
commit eafa800416
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/usb/gadget/udc/lpc32xx_udc.c
View File

@ -1614,17 +1614,17 @@ static int lpc32xx_ep_enable(struct usb_ep *_ep,
const struct usb_endpoint_descriptor *desc) const struct usb_endpoint_descriptor *desc)
{ {
struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep); struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep);
struct lpc32xx_udc *udc = ep->udc; struct lpc32xx_udc *udc;
u16 maxpacket; u16 maxpacket;
u32 tmp; u32 tmp;
unsigned long flags; unsigned long flags;
/* Verify EP data */ /* Verify EP data */
if ((!_ep) || (!ep) || (!desc) || if ((!_ep) || (!ep) || (!desc) ||
(desc->bDescriptorType != USB_DT_ENDPOINT)) { (desc->bDescriptorType != USB_DT_ENDPOINT))
dev_dbg(udc->dev, "bad ep or descriptor\n");
return -EINVAL; return -EINVAL;
}
udc = ep->udc;
maxpacket = usb_endpoint_maxp(desc); maxpacket = usb_endpoint_maxp(desc);
if ((maxpacket == 0) || (maxpacket > ep->maxpacket)) { if ((maxpacket == 0) || (maxpacket > ep->maxpacket)) {
dev_dbg(udc->dev, "bad ep descriptor's packet size\n"); dev_dbg(udc->dev, "bad ep descriptor's packet size\n");
@ -1872,7 +1872,7 @@ static int lpc32xx_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value) static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value)
{ {
struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep); struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep);
struct lpc32xx_udc *udc = ep->udc; struct lpc32xx_udc *udc;
unsigned long flags; unsigned long flags;
if ((!ep) || (ep->hwep_num <= 1)) if ((!ep) || (ep->hwep_num <= 1))
@ -1882,6 +1882,7 @@ static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value)
if (ep->is_in) if (ep->is_in)
return -EAGAIN; return -EAGAIN;
udc = ep->udc;
spin_lock_irqsave(&udc->lock, flags); spin_lock_irqsave(&udc->lock, flags);
if (value == 1) { if (value == 1) {