A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 08:07:32 -04:00
Code Issues Projects Releases Packages Wiki Activity

USB: musb: Fix null pointer dereference issue

Browse source 
This patch fixes the following NULL pointer dereference issue.

Pointer 'request' returned from call to function 'next_request'
at line 748 may be NULL and may be dereferenced at line 792.

============
Code Snippet
============

748:  request = next_request(musb_ep);
785: if (dma && (csr & MUSB_RXCSR_DMAENAB)) {
	csr &= ~(MUSB_RXCSR_AUTOCLEAR
			| MUSB_RXCSR_DMAENAB
			| MUSB_RXCSR_DMAMODE);
	musb_writew(epio, MUSB_RXCSR,
		MUSB_RXCSR_P_WZC_BITS | csr);

792:	 request->actual += musb_ep->dma->actual_len;
		

Signed-off-by: Maulik Mankad <x0082077@ti.com>
Cc: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Maulik Mankad 2009-12-22 16:18:19 +05:30 • committed by Greg Kroah-Hartman
commit 0abdc36f06
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
drivers/usb/musb/musb_gadget.c
View file

@ -746,6 +746,8 @@ void musb_g_rx(struct musb *musb, u8 epnum)
musb_ep_select(mbase, epnum);
request = next_request(musb_ep);
if (!request)
return;
csr = musb_readw(epio, MUSB_RXCSR);
dma = is_dma_capable() ? musb_ep->dma : NULL;