diff options
| author | Sebastian Andrzej Siewior <bigeasy@linutronix.de> | 2012-01-25 15:18:58 +0100 |
|---|---|---|
| committer | Felipe Balbi <balbi@ti.com> | 2012-02-09 08:54:00 +0100 |
| commit | 20edfbb6a17f3007c1905e9849d8d306e318883b (patch) | |
| tree | 3546c5796c58573561a9217525020d9a88eb0977 /drivers/usb/gadget/dummy_hcd.c | |
| parent | usb: gadget: dummy_hcd: don't assign ->desc on error case (diff) | |
| download | linux-20edfbb6a17f3007c1905e9849d8d306e318883b.tar.xz linux-20edfbb6a17f3007c1905e9849d8d306e318883b.zip | |
usb: gadget: dummy_hcd: fix null-deref free req
_ep to ep is a pointer substraction so ep won't be zero unless _ep was
8. This was not intendent by the author, it was probably a typo while
checking for NULL of the argument.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Diffstat (limited to 'drivers/usb/gadget/dummy_hcd.c')
| -rw-r--r-- | drivers/usb/gadget/dummy_hcd.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c index 9170a4c7ced4..8cc1a88d21e7 100644 --- a/drivers/usb/gadget/dummy_hcd.c +++ b/drivers/usb/gadget/dummy_hcd.c @@ -599,8 +599,10 @@ static void dummy_free_request(struct usb_ep *_ep, struct usb_request *_req) struct dummy_ep *ep; struct dummy_request *req; + if (!_ep || !_req) + return; ep = usb_ep_to_dummy_ep(_ep); - if (!ep || !_req || (!ep->desc && _ep->name != ep0name)) + if (!ep->desc && _ep->name != ep0name) return; req = usb_request_to_dummy_request(_req); |