diff options
| author | Peter Chen <peter.chen@freescale.com> | 2015-03-11 10:07:47 +0800 |
|---|---|---|
| committer | Felipe Balbi <balbi@ti.com> | 2015-03-11 14:59:10 -0500 |
| commit | 005a64307d5d3ef895e7821df4cad7739bab392e (patch) | |
| tree | ecb7e5d25e488216143d204795927ddb6a327515 /drivers/usb/gadget | |
| parent | 72a472d2f912292457d6e3579df342c1138f26d5 (diff) | |
| download | op-kernel-dev-005a64307d5d3ef895e7821df4cad7739bab392e.zip op-kernel-dev-005a64307d5d3ef895e7821df4cad7739bab392e.tar.gz | |
usb: gadget: lpc32xxx_udc: Fix NULL dereference
udc is then checked for NULL, if NULL, it is then dereferenced as
udc->dev, it is found using Coccinelle.
We simplify the code to fix this problem, and we delete some conditions
at if {} which will never be met.
Reported-by: Tapasweni Pathak <tapaswenipathak@gmail.com>
Reported-by : Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Diffstat (limited to 'drivers/usb/gadget')
| -rw-r--r-- | drivers/usb/gadget/udc/lpc32xx_udc.c | 15 |
1 files changed, 3 insertions, 12 deletions
diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c index 27fd413..3b6a785 100644 --- a/drivers/usb/gadget/udc/lpc32xx_udc.c +++ b/drivers/usb/gadget/udc/lpc32xx_udc.c @@ -1803,23 +1803,14 @@ static int lpc32xx_ep_queue(struct usb_ep *_ep, req = container_of(_req, struct lpc32xx_request, req); ep = container_of(_ep, struct lpc32xx_ep, ep); - if (!_req || !_req->complete || !_req->buf || + if (!_ep || !_req || !_req->complete || !_req->buf || !list_empty(&req->queue)) return -EINVAL; udc = ep->udc; - if (!_ep) { - dev_dbg(udc->dev, "invalid ep\n"); - return -EINVAL; - } - - - if ((!udc) || (!udc->driver) || - (udc->gadget.speed == USB_SPEED_UNKNOWN)) { - dev_dbg(udc->dev, "invalid device\n"); - return -EINVAL; - } + if (udc->gadget.speed == USB_SPEED_UNKNOWN) + return -EPIPE; if (ep->lep) { struct lpc32xx_usbd_dd_gad *dd; |
