Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2b54fa6b authored by Paul Zimmerman's avatar Paul Zimmerman Committed by Greg Kroah-Hartman
Browse files

usb: dwc2: fix dereference before NULL check 



In a couple of places, we were checking qtd->urb for NULL after
we had already dereferenced it. Fix this by moving the check to
before the dereference.

Signed-off-by: default avatarPaul Zimmerman <paulz@synopsys.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 0f94388b

drivers/usb/dwc2/hcd_intr.c

+9 −5
Original line number Original line Diff line number Diff line
@@ -975,8 +975,8 @@ static void dwc2_hc_xfercomp_intr(struct dwc2_hsotg *hsotg, 
				  struct dwc2_qtd *qtd)

				  struct dwc2_qtd *qtd)

{

{

	struct dwc2_hcd_urb *urb = qtd->urb;

	struct dwc2_hcd_urb *urb = qtd->urb;

	int pipe_type = dwc2_hcd_get_pipe_type(&urb->pipe_info);

	enum dwc2_halt_status halt_status = DWC2_HC_XFER_COMPLETE;

	enum dwc2_halt_status halt_status = DWC2_HC_XFER_COMPLETE;

	int pipe_type;

	int urb_xfer_done;

	int urb_xfer_done;





	if (dbg_hc(chan))

	if (dbg_hc(chan))
@@ -984,6 +984,11 @@ static void dwc2_hc_xfercomp_intr(struct dwc2_hsotg *hsotg, 
			 "--Host Channel %d Interrupt: Transfer Complete--\n",

			 "--Host Channel %d Interrupt: Transfer Complete--\n",

			 chnum);

			 chnum);





	if (!urb)

		goto handle_xfercomp_done;



	pipe_type = dwc2_hcd_get_pipe_type(&urb->pipe_info);



	if (hsotg->core_params->dma_desc_enable > 0) {

	if (hsotg->core_params->dma_desc_enable > 0) {

		dwc2_hcd_complete_xfer_ddma(hsotg, chan, chnum, halt_status);

		dwc2_hcd_complete_xfer_ddma(hsotg, chan, chnum, halt_status);

		if (pipe_type == USB_ENDPOINT_XFER_ISOC)

		if (pipe_type == USB_ENDPOINT_XFER_ISOC)
@@ -1005,9 +1010,6 @@ static void dwc2_hc_xfercomp_intr(struct dwc2_hsotg *hsotg, 
		}

		}

	}

	}





	if (!urb)

		goto handle_xfercomp_done;



	/* Update the QTD and URB states */

	/* Update the QTD and URB states */

	switch (pipe_type) {

	switch (pipe_type) {

	case USB_ENDPOINT_XFER_CONTROL:

	case USB_ENDPOINT_XFER_CONTROL:
@@ -1105,7 +1107,7 @@ static void dwc2_hc_stall_intr(struct dwc2_hsotg *hsotg, 
			       struct dwc2_qtd *qtd)

			       struct dwc2_qtd *qtd)

{

{

	struct dwc2_hcd_urb *urb = qtd->urb;

	struct dwc2_hcd_urb *urb = qtd->urb;

	int pipe_type = dwc2_hcd_get_pipe_type(&urb->pipe_info);

	int pipe_type;





	dev_dbg(hsotg->dev, "--Host Channel %d Interrupt: STALL Received--\n",

	dev_dbg(hsotg->dev, "--Host Channel %d Interrupt: STALL Received--\n",

		chnum);

		chnum);
@@ -1119,6 +1121,8 @@ static void dwc2_hc_stall_intr(struct dwc2_hsotg *hsotg, 
	if (!urb)

	if (!urb)

		goto handle_stall_halt;

		goto handle_stall_halt;





	pipe_type = dwc2_hcd_get_pipe_type(&urb->pipe_info);



	if (pipe_type == USB_ENDPOINT_XFER_CONTROL)

	if (pipe_type == USB_ENDPOINT_XFER_CONTROL)

		dwc2_host_complete(hsotg, qtd, -EPIPE);

		dwc2_host_complete(hsotg, qtd, -EPIPE);