Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 20edfbb6 authored by Sebastian Andrzej Siewior's avatar Sebastian Andrzej Siewior Committed by Felipe Balbi
Browse files

usb: gadget: dummy_hcd: fix null-deref free req 



_ep to ep is a pointer substraction so ep won't be zero unless _ep was
8. This was not intendent by the author, it was probably a typo while
checking for NULL of the argument.

Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
parent 3cf0ad02

drivers/usb/gadget/dummy_hcd.c

+3 −1
Original line number Diff line number Diff line
@@ -599,8 +599,10 @@ static void dummy_free_request(struct usb_ep *_ep, struct usb_request *_req) 
	struct dummy_ep		*ep;

	struct dummy_request	*req;



	if (!_ep || !_req)

		return;

	ep = usb_ep_to_dummy_ep(_ep);

	if (!ep || !_req || (!ep->desc && _ep->name != ep0name))

	if (!ep->desc && _ep->name != ep0name)

		return;



	req = usb_request_to_dummy_request(_req);