From 0abdc36f066ae20521b8c8d306725dd59a0d50aa Mon Sep 17 00:00:00 2001 From: Maulik Mankad Date: Tue, 22 Dec 2009 16:18:19 +0530 Subject: USB: musb: Fix null pointer dereference issue This patch fixes the following NULL pointer dereference issue. Pointer 'request' returned from call to function 'next_request' at line 748 may be NULL and may be dereferenced at line 792. ============ Code Snippet ============ 748: request = next_request(musb_ep); 785: if (dma && (csr & MUSB_RXCSR_DMAENAB)) { csr &= ~(MUSB_RXCSR_AUTOCLEAR | MUSB_RXCSR_DMAENAB | MUSB_RXCSR_DMAMODE); musb_writew(epio, MUSB_RXCSR, MUSB_RXCSR_P_WZC_BITS | csr); 792: request->actual += musb_ep->dma->actual_len; Signed-off-by: Maulik Mankad Cc: Felipe Balbi Signed-off-by: Greg Kroah-Hartman --- drivers/usb/musb/musb_gadget.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/usb') diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c index ac306985a8a1..cbcf14a236e6 100644 --- a/drivers/usb/musb/musb_gadget.c +++ b/drivers/usb/musb/musb_gadget.c @@ -746,6 +746,8 @@ void musb_g_rx(struct musb *musb, u8 epnum) musb_ep_select(mbase, epnum); request = next_request(musb_ep); + if (!request) + return; csr = musb_readw(epio, MUSB_RXCSR); dma = is_dma_capable() ? musb_ep->dma : NULL; -- cgit v1.2.3-58-ga151