usb: dwc2: avoid NULL dereferences
authorJohn Keeping <john@metanate.com>
Sun, 15 Jul 2018 14:50:43 +0000 (15:50 +0100)
committerFelipe Balbi <felipe.balbi@linux.intel.com>
Tue, 17 Jul 2018 07:12:51 +0000 (10:12 +0300)
For unidirectional endpoints, the endpoint pointer will be NULL for the
unused direction.  Check that the endpoint is active before
dereferencing this pointer.

Fixes: 1b4977c793d3 ("usb: dwc2: Update dwc2_handle_incomplete_isoc_in() function")
Fixes: 689efb2619b5 ("usb: dwc2: Update dwc2_handle_incomplete_isoc_out() function")
Fixes: d84845522d93 ("usb: dwc2: Update GINTSTS_GOUTNAKEFF interrupt handling")
Signed-off-by: John Keeping <john@metanate.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
drivers/usb/dwc2/gadget.c

index a0f82cc..cefc99a 100644 (file)
@@ -3430,7 +3430,7 @@ static void dwc2_gadget_handle_incomplete_isoc_in(struct dwc2_hsotg *hsotg)
        for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                hs_ep = hsotg->eps_in[idx];
                /* Proceed only unmasked ISOC EPs */
-               if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
+               if ((BIT(idx) & ~daintmsk) || !hs_ep->isochronous)
                        continue;
 
                epctrl = dwc2_readl(hsotg->regs + DIEPCTL(idx));
@@ -3476,7 +3476,7 @@ static void dwc2_gadget_handle_incomplete_isoc_out(struct dwc2_hsotg *hsotg)
        for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                hs_ep = hsotg->eps_out[idx];
                /* Proceed only unmasked ISOC EPs */
-               if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
+               if ((BIT(idx) & ~daintmsk) || !hs_ep->isochronous)
                        continue;
 
                epctrl = dwc2_readl(hsotg->regs + DOEPCTL(idx));
@@ -3650,7 +3650,7 @@ irq_retry:
                for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                        hs_ep = hsotg->eps_out[idx];
                        /* Proceed only unmasked ISOC EPs */
-                       if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
+                       if ((BIT(idx) & ~daintmsk) || !hs_ep->isochronous)
                                continue;
 
                        epctrl = dwc2_readl(hsotg->regs + DOEPCTL(idx));