From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date: Wed, 25 Jan 2012 14:18:58 +0000 (+0100)
Subject: usb: gadget: dummy_hcd: fix null-deref free req
X-Git-Tag: accepted/tizen/common/20141203.182822~5108^2~22^2~39^2~29
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=20edfbb6a17f3007c1905e9849d8d306e318883b;p=platform%2Fkernel%2Flinux-arm64.git

usb: gadget: dummy_hcd: fix null-deref free req

_ep to ep is a pointer substraction so ep won't be zero unless _ep was
8. This was not intendent by the author, it was probably a typo while
checking for NULL of the argument.

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Felipe Balbi <balbi@ti.com>
---

diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index 9170a4c..8cc1a88 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -599,8 +599,10 @@ static void dummy_free_request(struct usb_ep *_ep, struct usb_request *_req)
 	struct dummy_ep		*ep;
 	struct dummy_request	*req;
 
+	if (!_ep || !_req)
+		return;
 	ep = usb_ep_to_dummy_ep(_ep);
-	if (!ep || !_req || (!ep->desc && _ep->name != ep0name))
+	if (!ep->desc && _ep->name != ep0name)
 		return;
 
 	req = usb_request_to_dummy_request(_req);