Commit 5becc7c0 authored Nov 14, 2017 by Colin Ian King Committed by Greg Kroah-Hartman Feb 07, 2018

usb: gadget: don't dereference g until after it has been null checked




[ Upstream commit b2fc059fa549fe6881d4c1f8d698b0f50bcd16ec ]

Avoid dereferencing pointer g until after g has been sanity null checked;
move the assignment of cdev much later when it is required into a more
local scope.

Detected by CoverityScan, CID#1222135 ("Dereference before null check")

Fixes: b785ea7c ("usb: gadget: composite: fix ep->maxburst initialization")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent aba82d11

drivers/usb/gadget/composite.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -103,7 +103,6 @@ int config_ep_by_speed(struct usb_gadget *g,
		struct usb_function *f,
		struct usb_ep *_ep)
		{
		struct usb_composite_dev *cdev = get_gadget_data(g);
		struct usb_endpoint_descriptor *chosen_desc = NULL;
		struct usb_descriptor_header **speed_desc = NULL;

		@@ -170,8 +169,12 @@ ep_found:
		_ep->maxburst = comp_desc->bMaxBurst + 1;
		break;
		default:
		if (comp_desc->bMaxBurst != 0)
		if (comp_desc->bMaxBurst != 0) {
		struct usb_composite_dev *cdev;

		cdev = get_gadget_data(g);
		ERROR(cdev, "ep0 bMaxBurst must be 0\n");
		}
		_ep->maxburst = 1;
		break;
		}