Forwarded: [PATCH] usb: gadget: f_midi2: Fix null dereference

[syzbot <syzbot+bbb6dad313f4aaa8da6b@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] usb: gadget: f_midi2: Fix null dereference
Author: michail.tatas@gmail.com

#syz test

f_midi2_bind only binds if 
  if (... != SNDRV_UMP_DIR_OUTPUT)
  ...
  if (... != SNDRV_UMP_DIR_INPUT)
  ...

When f_midi2_set_alt gets called, it uncoditionally calls
f_midi2_stop_eps which triggers a null dereference in
f_midi2_free_ep_reqs

Add guard to catch dereference in f_midi2_free_ep_reqs like 
f_midi2_drop_reqs already has

Signed-off-by: Michail Tatas <michail.tatas@gmail.com>
---
 drivers/usb/gadget/function/f_midi2.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/gadget/function/f_midi2.c b/drivers/usb/gadget/function/f_midi2.c
index 19fdac024343..b9bb09c4b51a 100644
--- a/drivers/usb/gadget/function/f_midi2.c
+++ b/drivers/usb/gadget/function/f_midi2.c
@@ -1163,6 +1163,9 @@ static void f_midi2_free_ep_reqs(struct f_midi2_usb_ep *usb_ep)
 	struct f_midi2 *midi2 = usb_ep->card;
 	int i;
 
+	if (!usb_ep->usb_ep || !usb_ep->num_reqs)
+		return;
+
 	for (i = 0; i < midi2->info.num_reqs; i++) {
 		if (!usb_ep->reqs[i].req)
 			continue;
@@ -1203,6 +1206,9 @@ static int f_midi2_init_ep(struct f_midi2 *midi2, struct f_midi2_ep *ep,
 /* Free EP */
 static void f_midi2_free_ep(struct f_midi2_usb_ep *usb_ep)
 {
+	if(!usb_ep->usb_ep)
+		return;
+
 	f_midi2_drop_reqs(usb_ep);
 
 	f_midi2_free_ep_reqs(usb_ep);
-- 
2.43.0