Commit eafa8004 authored by Colin Ian King's avatar Colin Ian King Committed by Felipe Balbi
Browse files

usb: gadget: lpc32xx_udc: don't dereference ep pointer before null check 



Currently pointer ep is being dereferenced before it is null checked
leading to a null pointer dereference issue.  Fix this by only assigning
pointer udc once ep is known to be not null.  Also remove a debug
message that requires a valid udc which may not be possible at that
point.

Addresses-Coverity: ("Dereference before null check")
Fixes: 24a28e42 ("USB: gadget driver for LPC32xx")
Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
parent 1c0e69ae

drivers/usb/gadget/udc/lpc32xx_udc.c

+6 −5
Original line number Diff line number Diff line
@@ -1614,17 +1614,17 @@ static int lpc32xx_ep_enable(struct usb_ep *_ep, 
			     const struct usb_endpoint_descriptor *desc)

{

	struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep);

	struct lpc32xx_udc *udc = ep->udc;

	struct lpc32xx_udc *udc;

	u16 maxpacket;

	u32 tmp;

	unsigned long flags;



	/* Verify EP data */

	if ((!_ep) || (!ep) || (!desc) ||

	    (desc->bDescriptorType != USB_DT_ENDPOINT)) {

		dev_dbg(udc->dev, "bad ep or descriptor\n");

	    (desc->bDescriptorType != USB_DT_ENDPOINT))

		return -EINVAL;

	}



	udc = ep->udc;

	maxpacket = usb_endpoint_maxp(desc);

	if ((maxpacket == 0) || (maxpacket > ep->maxpacket)) {

		dev_dbg(udc->dev, "bad ep descriptor's packet size\n");
@@ -1872,7 +1872,7 @@ static int lpc32xx_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req) 
static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value)

{

	struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep);

	struct lpc32xx_udc *udc = ep->udc;

	struct lpc32xx_udc *udc;

	unsigned long flags;



	if ((!ep) || (ep->hwep_num <= 1))
@@ -1882,6 +1882,7 @@ static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value) 
	if (ep->is_in)

		return -EAGAIN;



	udc = ep->udc;

	spin_lock_irqsave(&udc->lock, flags);



	if (value == 1) {