Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 788beeb2 authored by Hemant Kumar's avatar Hemant Kumar
Browse files

usb: gadget: f_uac2: Check return value from config_ep_by_speed() 



In case config_ep_by_speed() returns error, endpoint descriptors
would not get populated. This results into NULL pointer dereference
when ep desc is accessed later. Fix this by bailing out set_alt if
config_ep_by_speed() API returns error.

Change-Id: Iaf9a0001973753988ff200edad3ed8587b6a4181
Signed-off-by: default avatarHemant Kumar <hemantk@codeaurora.org>
parent f6f026ce

drivers/usb/gadget/function/u_audio.c

+9 −4
Original line number Diff line number Diff line
@@ -402,11 +402,14 @@ int u_audio_start_capture(struct g_audio *audio_dev) 
	struct usb_ep *ep;

	struct uac_rtd_params *prm;

	struct uac_params *params = &audio_dev->params;

	int req_len, i;

	int req_len, i, ret;



	ep = audio_dev->out_ep;

	prm = &uac->c_prm;

	config_ep_by_speed(gadget, &audio_dev->func, ep);

	ret = config_ep_by_speed(gadget, &audio_dev->func, ep);

	if (ret)

		return ret;



	req_len = prm->max_psize;



	prm->ep_enabled = true;
@@ -455,11 +458,13 @@ int u_audio_start_playback(struct g_audio *audio_dev) 
	struct uac_params *params = &audio_dev->params;

	unsigned int factor, rate;

	const struct usb_endpoint_descriptor *ep_desc;

	int req_len, i;

	int req_len, i, ret;



	ep = audio_dev->in_ep;

	prm = &uac->p_prm;

	config_ep_by_speed(gadget, &audio_dev->func, ep);

	ret = config_ep_by_speed(gadget, &audio_dev->func, ep);

	if (ret)

		return ret;



	ep_desc = ep->desc;