From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755811AbcCNTU5 (ORCPT ); Mon, 14 Mar 2016 15:20:57 -0400 Received: from dougal.metanate.com ([90.155.101.14]:28322 "EHLO metanate.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753214AbcCNTUz (ORCPT ); Mon, 14 Mar 2016 15:20:55 -0400 From: John Keeping To: John Youn Cc: John Keeping , Greg Kroah-Hartman , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] usb: dwc2: gadget: avoid null dereference on incomplete transfer Date: Mon, 14 Mar 2016 19:20:14 +0000 Message-Id: <1457983214-4317-1-git-send-email-john@metanate.com> X-Mailer: git-send-email 2.7.0.226.gfe986fe Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Setting up a gadget with the uac2 function results in: Unable to handle kernel NULL pointer dereference at virtual address 00000058 ... PC is at dwc2_hsotg_irq+0x7f0/0x908 LR is at dwc2_hsotg_irq+0x4c/0x908 Backtrace: [] (dwc2_hsotg_irq) from [] (handle_irq_event_percpu+0x130/0x3ec) [] (handle_irq_event_percpu) from [] (handle_irq_event+0x48/0x6c) In all other loops we already skip endpoints that are null, so do so here as well. Signed-off-by: John Keeping --- drivers/usb/dwc2/gadget.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c index 0abf73c..df43ec0 100644 --- a/drivers/usb/dwc2/gadget.c +++ b/drivers/usb/dwc2/gadget.c @@ -2606,7 +2606,9 @@ irq_retry: for (idx = 1; idx < hsotg->num_of_eps; idx++) { hs_ep = hsotg->eps_in[idx]; - if (!hs_ep->isochronous || hs_ep->has_correct_parity) + if (!hs_ep || + !hs_ep->isochronous || + hs_ep->has_correct_parity) continue; epctl_reg = DIEPCTL(idx); @@ -2623,7 +2625,9 @@ irq_retry: for (idx = 1; idx < hsotg->num_of_eps; idx++) { hs_ep = hsotg->eps_out[idx]; - if (!hs_ep->isochronous || hs_ep->has_correct_parity) + if (!hs_ep || + !hs_ep->isochronous || + hs_ep->has_correct_parity) continue; epctl_reg = DOEPCTL(idx); -- 2.7.0.226.gfe986fe