get_status(), clear_feature() and set_feature() look up an endpoint
via m66592->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK] and
immediately dereference the result.

epaddr2ep[] is only populated for EP0 at probe time and for other
endpoints when they are enabled via m66592_ep_setting().  If a USB
host sends a GET_STATUS, CLEAR_FEATURE or SET_FEATURE request
targeting an endpoint number that has not been enabled, the lookup
returns NULL and the subsequent dereference causes a kernel oops.

Add a NULL check after each lookup and stall EP0 on invalid
endpoints, consistent with the error handling already used in the
default cases of these switch statements.

Fixes: 0f91349b89f3 ("usb: gadget: m66592-udc: Add support for M66592 USB peripheral controller")
Cc: stable@vger.kernel.org
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/usb/gadget/udc/m66592-udc.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/usb/gadget/udc/m66592-udc.c b/drivers/usb/gadget/udc/m66592-udc.c
index d77c11c4e..1d0755f79 100644
--- a/drivers/usb/gadget/udc/m66592-udc.c
+++ b/drivers/usb/gadget/udc/m66592-udc.c
@@ -977,6 +977,10 @@ __acquires(m66592->lock)
 		break;
 	case USB_RECIP_ENDPOINT:
 		ep = m66592->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK];
+		if (!ep) {
+			pipe_stall(m66592, 0);
+			return;		/* exit */
+		}
 		pid = control_reg_get_pid(m66592, ep->pipenum);
 		if (pid == M66592_PID_STALL)
 			status = 1 << USB_ENDPOINT_HALT;
@@ -1012,6 +1016,10 @@ static void clear_feature(struct m66592 *m66592, struct usb_ctrlrequest *ctrl)
 		u16 w_index = le16_to_cpu(ctrl->wIndex);
 
 		ep = m66592->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK];
+		if (!ep) {
+			pipe_stall(m66592, 0);
+			break;
+		}
 		pipe_stop(m66592, ep->pipenum);
 		control_reg_sqclr(m66592, ep->pipenum);
 
@@ -1069,6 +1077,10 @@ static void set_feature(struct m66592 *m66592, struct usb_ctrlrequest *ctrl)
 		u16 w_index = le16_to_cpu(ctrl->wIndex);
 
 		ep = m66592->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK];
+		if (!ep) {
+			pipe_stall(m66592, 0);
+			break;
+		}
 		pipe_stall(m66592, ep->pipenum);
 
 		control_end(m66592, 1);
-- 
2.50.1