Skip to content

Commit

Permalink
USB: musb: Fix null pointer dereference issue
Browse files Browse the repository at this point in the history
This patch fixes the following NULL pointer dereference issue.

Pointer 'request' returned from call to function 'next_request'
at line 748 may be NULL and may be dereferenced at line 792.

============
Code Snippet
============

748:  request = next_request(musb_ep);
785: if (dma && (csr & MUSB_RXCSR_DMAENAB)) {
	csr &= ~(MUSB_RXCSR_AUTOCLEAR
			| MUSB_RXCSR_DMAENAB
			| MUSB_RXCSR_DMAMODE);
	musb_writew(epio, MUSB_RXCSR,
		MUSB_RXCSR_P_WZC_BITS | csr);

792:	 request->actual += musb_ep->dma->actual_len;
		

Signed-off-by: Maulik Mankad <x0082077@ti.com>
Cc: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  • Loading branch information
Maulik Mankad authored and Greg Kroah-Hartman committed Dec 23, 2009
1 parent 796a83f commit 0abdc36
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions drivers/usb/musb/musb_gadget.c
Original file line number Diff line number Diff line change
Expand Up @@ -746,6 +746,8 @@ void musb_g_rx(struct musb *musb, u8 epnum)
musb_ep_select(mbase, epnum);

request = next_request(musb_ep);
if (!request)
return;

csr = musb_readw(epio, MUSB_RXCSR);
dma = is_dma_capable() ? musb_ep->dma : NULL;
Expand Down

0 comments on commit 0abdc36

Please sign in to comment.