Skip to contentSkip to conversation

usb: ci_udc: fix request allocation when endpoints are disabled

PATCH New Rob Herring 3 participants 3 messages Jul 24, 2015 USB

lore
Share & tools
lore

Rob Herring

author
#0 lore raw

PATCH 1/1 usb: ci_udc: fix request allocation when endpoints are disabled

The ci_udc driver request allocation assumes that the endpoint descriptor pointer is set to retrieve the endpoint number, but that is only true when the endpoint is enabled. This results in a NULL ptr dereference which for me happens to return 0 value. This causes the EP0 request struct to be returned for other endpoints. Some gadget drivers like fastboot and USB MS work fine, but ethernet does not.

Really, the ci_udc driver is the oddball here doing this EP0 special case handling Stephen added. All the other drivers alloc/free functions are pretty much the same with the only variation being the size of the private struct. This could all be consolidated to a common function.

Signed-off-by Rob Herring <[email protected]>
Cc Marek Vasut <[email protected]>
Cc Stephen Warren <[email protected]>
---
 drivers/usb/gadget/ci_udc.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/usb/gadget/ci_udc.c +8 -4
index aadff42..4b8dccc 100644
@@ -258,10 +258,12 @@ static struct usb_request *
 ci_ep_alloc_request(struct usb_ep *ep, unsigned int gfp_flags)
 {
 	struct ci_ep *ci_ep = container_of(ep, struct ci_ep, ep);
-	int num;
+	int num = -1;
 	struct ci_req *ci_req;
 
-	num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
+	if (ci_ep->desc)
+		num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
+
 	if (num == 0 && controller.ep0_req)
 		return &controller.ep0_req->req;
 

@@ -281,9 +283,11 @@ static void ci_ep_free_request(struct usb_ep *ep, struct usb_request *req)
 {
 	struct ci_ep *ci_ep = container_of(ep, struct ci_ep, ep);
 	struct ci_req *ci_req = container_of(req, struct ci_req, req);
-	int num;
+	int num = -1;
+
+	if (ci_ep->desc)
+		num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
 
-	num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
 	if (num == 0) {
 		if (!controller.ep0_req)
 			return;
Signature · 1 line
2.1.0
#1 lore raw

PATCH 1/1 usb: ci_udc: fix request allocation when endpoints are disabled

Quoted 11 lines · Rob Herring

The ci_udc driver request allocation assumes that the endpoint descriptor pointer is set to retrieve the endpoint number, but that is only true when the endpoint is enabled. This results in a NULL ptr dereference which for me happens to return 0 value. This causes the EP0 request struct to be returned for other endpoints. Some gadget drivers like fastboot and USB MS work fine, but ethernet does not.

Really, the ci_udc driver is the oddball here doing this EP0 special case handling Stephen added. All the other drivers alloc/free functions are pretty much the same with the only variation being the size of the private struct. This could all be consolidated to a common function.

Acked-by Stephen Warren <[email protected]>
Applied
#2 lore raw

PATCH 1/1 usb: ci_udc: fix request allocation when endpoints are disabled

In reply to Rob Herring
Quoted 7 lines · Rob Herring

The ci_udc driver request allocation assumes that the endpoint descriptor pointer is set to retrieve the endpoint number, but that is only true when the endpoint is enabled. This results in a NULL ptr dereference which for me happens to return 0 value. This causes the EP0 request struct to be returned for other endpoints. Some gadget drivers like fastboot and USB MS work fine, but ethernet does not.

Quoted 8 lines

Really, the ci_udc driver is the oddball here doing this EP0 special case handling Stephen added. All the other drivers alloc/free functions are pretty much the same with the only variation being the size of the private struct. This could all be consolidated to a common function.

Signed-off-by Rob Herring <[email protected]>
Cc Marek Vasut <[email protected]>
Cc Stephen Warren <[email protected]>

Applied, thanks!

Best regards,
Marek Vasut