diff options
author | Felipe Balbi <balbi@ti.com> | 2014-11-10 15:39:44 -0500 |
---|---|---|
committer | Felipe Balbi <balbi@ti.com> | 2014-11-10 15:39:44 -0500 |
commit | 520fe7633692181bb6d1560d655fbdfbb7c05aaa (patch) | |
tree | a1d9f9593aa0fcfa986189c8fbc5b9d990cf873a /drivers/usb | |
parent | 206c5f60a3d902bc4b56dab2de3e88de5eb06108 (diff) |
usb: dwc3: ep0: fix for dead code
commit 6856d30 (usb: dwc3: ep0: return early
on NULL requests) tried to fix a minor corner
case where we could dereference a NULL pointer
but it also ended up introducing some dead code.
Unfortunately, that dead code, if reached, could
end up starving the endpoint request list because
a request would never be given back when it should.
Fix this by moving the check for empty request list
before its first use.
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Diffstat (limited to 'drivers/usb')
-rw-r--r-- | drivers/usb/dwc3/ep0.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c index 711b23019d54..df38e7ef4976 100644 --- a/drivers/usb/dwc3/ep0.c +++ b/drivers/usb/dwc3/ep0.c | |||
@@ -791,6 +791,10 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc, | |||
791 | 791 | ||
792 | trb = dwc->ep0_trb; | 792 | trb = dwc->ep0_trb; |
793 | 793 | ||
794 | r = next_request(&ep0->request_list); | ||
795 | if (!r) | ||
796 | return; | ||
797 | |||
794 | status = DWC3_TRB_SIZE_TRBSTS(trb->size); | 798 | status = DWC3_TRB_SIZE_TRBSTS(trb->size); |
795 | if (status == DWC3_TRBSTS_SETUP_PENDING) { | 799 | if (status == DWC3_TRBSTS_SETUP_PENDING) { |
796 | dwc3_trace(trace_dwc3_ep0, "Setup Pending received"); | 800 | dwc3_trace(trace_dwc3_ep0, "Setup Pending received"); |
@@ -801,10 +805,6 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc, | |||
801 | return; | 805 | return; |
802 | } | 806 | } |
803 | 807 | ||
804 | r = next_request(&ep0->request_list); | ||
805 | if (!r) | ||
806 | return; | ||
807 | |||
808 | ur = &r->request; | 808 | ur = &r->request; |
809 | 809 | ||
810 | length = trb->size & DWC3_TRB_SIZE_MASK; | 810 | length = trb->size & DWC3_TRB_SIZE_MASK; |