| Message ID | 1437750861-6489-1-git-send-email-robh@kernel.org |
|---|---|
| State | Accepted |
| Delegated to: | Marek Vasut |
| Headers | show |
On 07/24/2015 09:14 AM, Rob Herring wrote: > The ci_udc driver request allocation assumes that the endpoint descriptor > pointer is set to retrieve the endpoint number, but that is only true > when the endpoint is enabled. This results in a NULL ptr dereference > which for me happens to return 0 value. This causes the EP0 request > struct to be returned for other endpoints. Some gadget drivers like > fastboot and USB MS work fine, but ethernet does not. > > Really, the ci_udc driver is the oddball here doing this EP0 special > case handling Stephen added. All the other drivers alloc/free functions > are pretty much the same with the only variation being the size of the > private struct. This could all be consolidated to a common function. Acked-by: Stephen Warren <swarren@nvidia.com>
On Friday, July 24, 2015 at 05:14:21 PM, Rob Herring wrote: > The ci_udc driver request allocation assumes that the endpoint descriptor > pointer is set to retrieve the endpoint number, but that is only true > when the endpoint is enabled. This results in a NULL ptr dereference > which for me happens to return 0 value. This causes the EP0 request > struct to be returned for other endpoints. Some gadget drivers like > fastboot and USB MS work fine, but ethernet does not. > > Really, the ci_udc driver is the oddball here doing this EP0 special > case handling Stephen added. All the other drivers alloc/free functions > are pretty much the same with the only variation being the size of the > private struct. This could all be consolidated to a common function. > > Signed-off-by: Rob Herring <robh@kernel.org> > Cc: Marek Vasut <marex@denx.de> > Cc: Stephen Warren <swarren@nvidia.com> Applied, thanks! Best regards, Marek Vasut
diff --git a/drivers/usb/gadget/ci_udc.c b/drivers/usb/gadget/ci_udc.c index aadff42..4b8dccc 100644 --- a/drivers/usb/gadget/ci_udc.c +++ b/drivers/usb/gadget/ci_udc.c @@ -258,10 +258,12 @@ static struct usb_request * ci_ep_alloc_request(struct usb_ep *ep, unsigned int gfp_flags) { struct ci_ep *ci_ep = container_of(ep, struct ci_ep, ep); - int num; + int num = -1; struct ci_req *ci_req; - num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK; + if (ci_ep->desc) + num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK; + if (num == 0 && controller.ep0_req) return &controller.ep0_req->req; @@ -281,9 +283,11 @@ static void ci_ep_free_request(struct usb_ep *ep, struct usb_request *req) { struct ci_ep *ci_ep = container_of(ep, struct ci_ep, ep); struct ci_req *ci_req = container_of(req, struct ci_req, req); - int num; + int num = -1; + + if (ci_ep->desc) + num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK; - num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK; if (num == 0) { if (!controller.ep0_req) return;
The ci_udc driver request allocation assumes that the endpoint descriptor pointer is set to retrieve the endpoint number, but that is only true when the endpoint is enabled. This results in a NULL ptr dereference which for me happens to return 0 value. This causes the EP0 request struct to be returned for other endpoints. Some gadget drivers like fastboot and USB MS work fine, but ethernet does not. Really, the ci_udc driver is the oddball here doing this EP0 special case handling Stephen added. All the other drivers alloc/free functions are pretty much the same with the only variation being the size of the private struct. This could all be consolidated to a common function. Signed-off-by: Rob Herring <robh@kernel.org> Cc: Marek Vasut <marex@denx.de> Cc: Stephen Warren <swarren@nvidia.com> --- drivers/usb/gadget/ci_udc.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)