usb: dwc3: gadget: Iterate only over valid endpoints

Make dwc3_gadget_resize_tx_fifos() iterate only over IN
endpoints that are actually present, based on the
num_in_eps parameter. This terminates the loop so as to
prevent dereferencing a potential NULL dwc->eps[i] where
i >= (num_in_eps + num_out_eps).

Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>

1 files changed, 4 insertions, 8 deletions

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index a740eac74d56..70715eeededd 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -187,15 +187,12 @@ int dwc3_gadget_resize_tx_fifos(struct dwc3 *dwc)
          * improve this algorithm so that we better use the internal
          * FIFO space
          */
-        for (num = 0; num < DWC3_ENDPOINTS_NUM; num++) {
-                struct dwc3_ep  *dep = dwc->eps[num];
-                int             fifo_number = dep->number >> 1;
+        for (num = 0; num < dwc->num_in_eps; num++) {
+                /* bit0 indicates direction; 1 means IN ep */
+                struct dwc3_ep  *dep = dwc->eps[(num << 1) | 1];
                 int             mult = 1;
                 int             tmp;
 
-                if (!(dep->number & 1))
-                        continue;
-
                 if (!(dep->flags & DWC3_EP_ENABLED))
                         continue;
 
@@ -224,8 +221,7 @@ int dwc3_gadget_resize_tx_fifos(struct dwc3 *dwc)
                 dev_vdbg(dwc->dev, "%s: Fifo Addr %04x Size %d\n",
                                 dep->name, last_fifo_depth, fifo_size & 0xffff);
 
-                dwc3_writel(dwc->regs, DWC3_GTXFIFOSIZ(fifo_number),
-                                fifo_size);
+                dwc3_writel(dwc->regs, DWC3_GTXFIFOSIZ(num), fifo_size);
 
                 last_fifo_depth += (fifo_size & 0xffff);
         }