From patchwork Thu Mar 15 08:34:17 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Patrice CHOTARD X-Patchwork-Id: 886147 X-Patchwork-Delegate: lukma@denx.de Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.denx.de (client-ip=81.169.180.215; helo=lists.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=st.com Received: from lists.denx.de (dione.denx.de [81.169.180.215]) by ozlabs.org (Postfix) with ESMTP id 40222M326Rz9sVY for ; Thu, 15 Mar 2018 19:34:35 +1100 (AEDT) Received: by lists.denx.de (Postfix, from userid 105) id E74ACC21DF9; Thu, 15 Mar 2018 08:34:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on lists.denx.de X-Spam-Level: X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=unavailable autolearn_force=no version=3.4.0 Received: from lists.denx.de (localhost [IPv6:::1]) by lists.denx.de (Postfix) with ESMTP id E545EC21C2F; Thu, 15 Mar 2018 08:34:29 +0000 (UTC) Received: by lists.denx.de (Postfix, from userid 105) id 6D949C21C2F; Thu, 15 Mar 2018 08:34:28 +0000 (UTC) Received: from mx07-00178001.pphosted.com (mx07-00178001.pphosted.com [62.209.51.94]) by lists.denx.de (Postfix) with ESMTPS id 20066C21BE5 for ; Thu, 15 Mar 2018 08:34:28 +0000 (UTC) Received: from pps.filterd (m0046037.ppops.net [127.0.0.1]) by mx07-.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id w2F8Xn2x004684; Thu, 15 Mar 2018 09:34:26 +0100 Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx07-00178001.pphosted.com with ESMTP id 2gqnbgr15c-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Thu, 15 Mar 2018 09:34:26 +0100 Received: from zeta.dmz-eu.st.com (zeta.dmz-eu.st.com [164.129.230.9]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id 003B531; Thu, 15 Mar 2018 08:34:25 +0000 (GMT) Received: from Webmail-eu.st.com (sfhdag6node3.st.com [10.75.127.18]) by zeta.dmz-eu.st.com (STMicroelectronics) with ESMTP id D183D1657; Thu, 15 Mar 2018 08:34:25 +0000 (GMT) Received: from localhost (10.75.127.44) by SFHDAG6NODE3.st.com (10.75.127.18) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Thu, 15 Mar 2018 09:34:25 +0100 From: To: Marek Vasut , Lukasz Majewski Date: Thu, 15 Mar 2018 09:34:17 +0100 Message-ID: <1521102857-6497-1-git-send-email-patrice.chotard@st.com> X-Mailer: git-send-email 1.9.1 MIME-Version: 1.0 X-Originating-IP: [10.75.127.44] X-ClientProxiedBy: SFHDAG1NODE3.st.com (10.75.127.3) To SFHDAG6NODE3.st.com (10.75.127.18) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2018-03-15_04:, , signatures=0 Cc: u-boot@lists.denx.de Subject: [U-Boot] [PATCH] usb: gadget: composite: fix NULL pointer when a non standard request is received X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.18 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" From: Christophe Kerello In case usb configuration is unknown (cdev->config == NULL), non standard request should not be processed. Remove also the cdev->config check below which will never happen. This issue was seen using ums feature. Signed-off-by: Christophe Kerello Signed-off-by: Patrice Chotard --- drivers/usb/gadget/composite.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index d0ee7847b98d..a87639def974 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -838,6 +838,9 @@ unknown: ctrl->bRequestType, ctrl->bRequest, w_value, w_index, w_length); + if (!cdev->config) + goto done; + /* * functions always handle their interfaces and endpoints... * punt other recipients (other, WUSB, ...) to the current @@ -882,7 +885,7 @@ unknown: value = f->setup(f, ctrl); else { c = cdev->config; - if (c && c->setup) + if (c->setup) value = c->setup(c, ctrl); }