diff options
author | Maulik Mankad <x0082077@ti.com> | 2009-12-22 05:48:19 -0500 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-12-23 14:34:19 -0500 |
commit | 0abdc36f066ae20521b8c8d306725dd59a0d50aa (patch) | |
tree | 39b8392093276bb1a5ae3bb68b8ebef8062ad4e3 | |
parent | 796a83fa039de50133171221ac102a2310e81ffd (diff) |
USB: musb: Fix null pointer dereference issue
This patch fixes the following NULL pointer dereference issue.
Pointer 'request' returned from call to function 'next_request'
at line 748 may be NULL and may be dereferenced at line 792.
============
Code Snippet
============
748: request = next_request(musb_ep);
785: if (dma && (csr & MUSB_RXCSR_DMAENAB)) {
csr &= ~(MUSB_RXCSR_AUTOCLEAR
| MUSB_RXCSR_DMAENAB
| MUSB_RXCSR_DMAMODE);
musb_writew(epio, MUSB_RXCSR,
MUSB_RXCSR_P_WZC_BITS | csr);
792: request->actual += musb_ep->dma->actual_len;
Signed-off-by: Maulik Mankad <x0082077@ti.com>
Cc: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r-- | drivers/usb/musb/musb_gadget.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c index ac306985a8a1..cbcf14a236e6 100644 --- a/drivers/usb/musb/musb_gadget.c +++ b/drivers/usb/musb/musb_gadget.c | |||
@@ -746,6 +746,8 @@ void musb_g_rx(struct musb *musb, u8 epnum) | |||
746 | musb_ep_select(mbase, epnum); | 746 | musb_ep_select(mbase, epnum); |
747 | 747 | ||
748 | request = next_request(musb_ep); | 748 | request = next_request(musb_ep); |
749 | if (!request) | ||
750 | return; | ||
749 | 751 | ||
750 | csr = musb_readw(epio, MUSB_RXCSR); | 752 | csr = musb_readw(epio, MUSB_RXCSR); |
751 | dma = is_dma_capable() ? musb_ep->dma : NULL; | 753 | dma = is_dma_capable() ? musb_ep->dma : NULL; |