[v2] usb: cdns3: gadget: fix NULL pointer dereference in ep_queue

[PATCH v2] usb: cdns3: gadget: fix NULL pointer dereference in ep_queue

Yongchao Wu posted 1 patch 4 days, 7 hours ago

Diff against v1 v1 v3
Download mbox

There is a newer version of this series

drivers/usb/cdns3/cdns3-gadget.c | 3 +++
1 file changed, 3 insertions(+)

Expand all Fold all

[PATCH v2] usb: cdns3: gadget: fix NULL pointer dereference in ep_queue

Posted by Yongchao Wu 4 days, 7 hours ago

When the gadget endpoint is disabled or not yet configured, the ep->desc
pointer can be NULL. This leads to a NULL pointer dereference when
__cdns3_gadget_ep_queue() is called, causing a kernel crash.

Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the
standard return code for unconfigured endpoints.

This prevents potential crashes when ep_queue is called on endpoints
that are not ready.

Signed-off-by: Yongchao Wu  <yongchao.wu@autochips.com>

---
Changes in v2:
  - Fix author name format (use "Yongchao Wu" instead of "yongchao.wu")
---
 drivers/usb/cdns3/cdns3-gadget.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
index d59a60a16..96d2a4c38 100644
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -2589,6 +2589,9 @@ static int __cdns3_gadget_ep_queue(struct usb_ep *ep,
 	struct cdns3_request *priv_req;
 	int ret = 0;
 
+	if (!ep->desc)
+		return -ESHUTDOWN;
+
 	request->actual = 0;
 	request->status = -EINPROGRESS;
 	priv_req = to_cdns3_request(request);
-- 
2.43.0