[PATCH 08/19] usb: gadget: uvc: fix oops on a premature STREAMON

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Josef Bacik <josef@toxicpanda.com>

VIDIOC_STREAMON ends in uvc_video_prep_requests(), which looks at the
descriptor of the streaming endpoint. video->ep->desc is NULL after
usb_ep_autoconfig(). It is set by config_ep_by_speed() when the host
selects alternate setting 1 of the streaming interface, and UDC drivers
such as dwc3 clear it again when the endpoint is disabled. An
application which allocates buffers and calls STREAMON without waiting
for the UVC_EVENT_STREAMON event dereferences a NULL pointer.

Return -ENODEV, as for a function which is not bound.

Fixes: 48dbe731171e ("usb: gadget: uvc: set req_size and n_requests based on the frame interval")
Cc: stable <stable@kernel.org>
Cc: Neill Kapron <nkapron@google.com>
Cc: Xu Yang <xu.yang_2@nxp.com>
Cc: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/uvc_video.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
index 9ba09118bb74..2a56536c3481 100644
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -770,6 +770,10 @@ int uvcg_video_enable(struct uvc_video *video)
 		return -ENODEV;
 	}
 
+	/* Set while the host has selected the streaming alternate setting. */
+	if (!video->ep->desc)
+		return -ENODEV;
+
 	/*
 	 * Safe to access request related fields without req_lock because
 	 * this is the only thread currently active, and no other

-- 
2.56.0