提交 20edfbb6 编写于 作者: S Sebastian Andrzej Siewior 提交者: Felipe Balbi

usb: gadget: dummy_hcd: fix null-deref free req

_ep to ep is a pointer substraction so ep won't be zero unless _ep was
8. This was not intendent by the author, it was probably a typo while
checking for NULL of the argument.
Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NFelipe Balbi <balbi@ti.com>
上级 3cf0ad02
...@@ -599,8 +599,10 @@ static void dummy_free_request(struct usb_ep *_ep, struct usb_request *_req) ...@@ -599,8 +599,10 @@ static void dummy_free_request(struct usb_ep *_ep, struct usb_request *_req)
struct dummy_ep *ep; struct dummy_ep *ep;
struct dummy_request *req; struct dummy_request *req;
if (!_ep || !_req)
return;
ep = usb_ep_to_dummy_ep(_ep); ep = usb_ep_to_dummy_ep(_ep);
if (!ep || !_req || (!ep->desc && _ep->name != ep0name)) if (!ep->desc && _ep->name != ep0name)
return; return;
req = usb_request_to_dummy_request(_req); req = usb_request_to_dummy_request(_req);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册