From 1e3f5743e68ce48a5d1d4c672c54b5cc4bfe8da5 Mon Sep 17 00:00:00 2001 From: Pratham Pratap Date: Tue, 5 Dec 2017 14:38:29 +0530 Subject: [PATCH] usb: dwc3: Avoid NULL pointer access During Halt Endpoint CH9 test with RNDIS composition NULL pointer dereference is occurring in __dwc3_gadget_ep_set_halt function which is trying to access trb_pool which is already freed. In this case set_alt 0 is getting called before__dwc3_gadget_ep_set_halt. As a part of set_alt, ipa_disconnect_handler is getting called which is freeing the trbs. __dwc3_gadget_ep_set_halt function is called as a part of std_request from Host side to halt endpoint. This change adds a NULL check before accessing trb_pool. Change-Id: Id51494310f713b9c593e29449442661a1170ee6f Signed-off-by: Pratham Pratap Signed-off-by: Jack Pham --- drivers/usb/dwc3/gadget.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index d944f17b9998..72190e693c26 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -982,6 +982,9 @@ static struct dwc3_trb *dwc3_ep_prev_trb(struct dwc3_ep *dep, u8 index) { u8 tmp = index; + if (!dep->trb_pool) + return NULL; + if (!tmp) tmp = DWC3_TRB_NUM - 1; @@ -1730,7 +1733,11 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol) else trb = &dwc->ep0_trb[dep->trb_enqueue]; - transfer_in_flight = trb->ctrl & DWC3_TRB_CTRL_HWO; + if (trb) + transfer_in_flight = trb->ctrl & DWC3_TRB_CTRL_HWO; + else + transfer_in_flight = false; + started = !list_empty(&dep->started_list); if (!protocol && ((dep->direction && transfer_in_flight) ||