Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0eb0db78 authored by Mayank Rana's avatar Mayank Rana
Browse files

dwc3: Add NULL check before accessing event buffer 



Event buffer may not been allocated or configured but software
may tried to deallocate or unconfigure same from EPROBE_DEFER
context which results into NULL pointer dereference. Fix this
issue by adding NULL check before accessing event buffer.

Change-Id: I1d6686e90e54ca17e8ee558f45378ce259eaaf53
Signed-off-by: default avatarMayank Rana <mrana@codeaurora.org>
parent 04a47c9b

drivers/usb/dwc3/core.c

+3 −0
Original line number Diff line number Diff line
@@ -428,6 +428,9 @@ static void dwc3_event_buffers_cleanup(struct dwc3 *dwc) 
{

	struct dwc3_event_buffer	*evt;



	if (!dwc->ev_buf)

		return;



	evt = dwc->ev_buf;



	evt->lpos = 0;

drivers/usb/dwc3/dwc3-msm.c

+9 −0
Original line number Diff line number Diff line
@@ -1867,6 +1867,9 @@ static void dwc3_msm_notify_event(struct dwc3 *dwc, unsigned int event) 
		dev_dbg(mdwc->dev, "DWC3_GSI_EVT_BUF_SETUP\n");

		for (i = 0; i < mdwc->num_gsi_event_buffers; i++) {

			evt = mdwc->gsi_ev_buff[i];

			if (!evt)

				break;



			dev_dbg(mdwc->dev, "Evt buf %p dma %08llx length %d\n",

				evt->buf, (unsigned long long) evt->dma,

				evt->length);
@@ -1892,6 +1895,9 @@ static void dwc3_msm_notify_event(struct dwc3 *dwc, unsigned int event) 
		break;

	case DWC3_GSI_EVT_BUF_CLEANUP:

		dev_dbg(mdwc->dev, "DWC3_GSI_EVT_BUF_CLEANUP\n");

		if (!mdwc->gsi_ev_buff)

			break;



		for (i = 0; i < mdwc->num_gsi_event_buffers; i++) {

			evt = mdwc->gsi_ev_buff[i];

			evt->lpos = 0;
@@ -1911,6 +1917,9 @@ static void dwc3_msm_notify_event(struct dwc3 *dwc, unsigned int event) 
		break;

	case DWC3_GSI_EVT_BUF_FREE:

		dev_dbg(mdwc->dev, "DWC3_GSI_EVT_BUF_FREE\n");

		if (!mdwc->gsi_ev_buff)

			break;



		for (i = 0; i < mdwc->num_gsi_event_buffers; i++) {

			evt = mdwc->gsi_ev_buff[i];

			if (evt)