Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c7309489 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "USB: gadget: ci13xxx_udc: Avoid NULL pointer dereference."

parents 91c5b834 e75eeeb4

drivers/usb/gadget/ci13xxx_udc.c

+9 −2
Original line number Diff line number Diff line
@@ -3079,8 +3079,11 @@ static int ep_queue(struct usb_ep *ep, struct usb_request *req, 


	trace("%pK, %pK, %X", ep, req, gfp_flags);



	if (ep == NULL)

		return -EINVAL;



	spin_lock_irqsave(mEp->lock, flags);

	if (ep == NULL || req == NULL || mEp->desc == NULL) {

	if (req == NULL || mEp->desc == NULL) {

		retval = -EINVAL;

		goto done;

	}
@@ -3218,12 +3221,16 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req) 
				__func__);

		return -EAGAIN;

	}



	if (ep == NULL)

		return -EINVAL;



	spin_lock_irqsave(mEp->lock, flags);

	/*

	 * Only ep0 IN is exposed to composite.  When a req is dequeued

	 * on ep0, check both ep0 IN and ep0 OUT queues.

	 */

	if (ep == NULL || req == NULL || mReq->req.status != -EALREADY ||

	if (req == NULL || mReq->req.status != -EALREADY ||

		mEp->desc == NULL || list_empty(&mReq->queue) ||

		(list_empty(&mEp->qh.queue) && ((mEp->type !=

			USB_ENDPOINT_XFER_CONTROL) ||