Skip to content

Commit

Permalink
usb: gadget: dummy_hcd: fix null-deref free req
Browse files Browse the repository at this point in the history
_ep to ep is a pointer substraction so ep won't be zero unless _ep was
8. This was not intendent by the author, it was probably a typo while
checking for NULL of the argument.

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Felipe Balbi <balbi@ti.com>
  • Loading branch information
Sebastian Andrzej Siewior authored and Felipe Balbi committed Feb 9, 2012
1 parent 3cf0ad0 commit 20edfbb
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion drivers/usb/gadget/dummy_hcd.c
Original file line number Diff line number Diff line change
Expand Up @@ -599,8 +599,10 @@ static void dummy_free_request(struct usb_ep *_ep, struct usb_request *_req)
struct dummy_ep *ep;
struct dummy_request *req;

if (!_ep || !_req)
return;
ep = usb_ep_to_dummy_ep(_ep);
if (!ep || !_req || (!ep->desc && _ep->name != ep0name))
if (!ep->desc && _ep->name != ep0name)
return;

req = usb_request_to_dummy_request(_req);
Expand Down

0 comments on commit 20edfbb

Please sign in to comment.