diff options
| author | Sebastian Andrzej Siewior <[email protected]> | 2012-01-25 15:18:58 +0100 |
|---|---|---|
| committer | Felipe Balbi <[email protected]> | 2012-02-09 09:54:00 +0200 |
| commit | 20edfbb6a17f3007c1905e9849d8d306e318883b (patch) | |
| tree | 3546c5796c58573561a9217525020d9a88eb0977 | |
| parent | 3cf0ad02e42a91e85ffe9bd67422dd266531d3ec (diff) | |
usb: gadget: dummy_hcd: fix null-deref free req
_ep to ep is a pointer substraction so ep won't be zero unless _ep was
8. This was not intendent by the author, it was probably a typo while
checking for NULL of the argument.
Signed-off-by: Sebastian Andrzej Siewior <[email protected]>
Acked-by: Alan Stern <[email protected]>
Signed-off-by: Felipe Balbi <[email protected]>
| -rw-r--r-- | drivers/usb/gadget/dummy_hcd.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c index 9170a4c7ced4..8cc1a88d21e7 100644 --- a/drivers/usb/gadget/dummy_hcd.c +++ b/drivers/usb/gadget/dummy_hcd.c @@ -599,8 +599,10 @@ static void dummy_free_request(struct usb_ep *_ep, struct usb_request *_req) struct dummy_ep *ep; struct dummy_request *req; + if (!_ep || !_req) + return; ep = usb_ep_to_dummy_ep(_ep); - if (!ep || !_req || (!ep->desc && _ep->name != ep0name)) + if (!ep->desc && _ep->name != ep0name) return; req = usb_request_to_dummy_request(_req); |