mirror of
https://github.com/brain-hackers/u-boot-brain
synced 2024-08-20 00:48:52 +09:00
usb: ci_udc: fix request allocation when endpoints are disabled
The ci_udc driver request allocation assumes that the endpoint descriptor pointer is set to retrieve the endpoint number, but that is only true when the endpoint is enabled. This results in a NULL ptr dereference which for me happens to return 0 value. This causes the EP0 request struct to be returned for other endpoints. Some gadget drivers like fastboot and USB MS work fine, but ethernet does not. Really, the ci_udc driver is the oddball here doing this EP0 special case handling Stephen added. All the other drivers alloc/free functions are pretty much the same with the only variation being the size of the private struct. This could all be consolidated to a common function. Signed-off-by: Rob Herring <robh@kernel.org> Cc: Marek Vasut <marex@denx.de> Acked-by: Stephen Warren <swarren@nvidia.com>
This commit is contained in:
parent
85a9ea314e
commit
58d6d139c3
@ -258,10 +258,12 @@ static struct usb_request *
|
|||||||
ci_ep_alloc_request(struct usb_ep *ep, unsigned int gfp_flags)
|
ci_ep_alloc_request(struct usb_ep *ep, unsigned int gfp_flags)
|
||||||
{
|
{
|
||||||
struct ci_ep *ci_ep = container_of(ep, struct ci_ep, ep);
|
struct ci_ep *ci_ep = container_of(ep, struct ci_ep, ep);
|
||||||
int num;
|
int num = -1;
|
||||||
struct ci_req *ci_req;
|
struct ci_req *ci_req;
|
||||||
|
|
||||||
num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
|
if (ci_ep->desc)
|
||||||
|
num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
|
||||||
|
|
||||||
if (num == 0 && controller.ep0_req)
|
if (num == 0 && controller.ep0_req)
|
||||||
return &controller.ep0_req->req;
|
return &controller.ep0_req->req;
|
||||||
|
|
||||||
@ -281,9 +283,11 @@ static void ci_ep_free_request(struct usb_ep *ep, struct usb_request *req)
|
|||||||
{
|
{
|
||||||
struct ci_ep *ci_ep = container_of(ep, struct ci_ep, ep);
|
struct ci_ep *ci_ep = container_of(ep, struct ci_ep, ep);
|
||||||
struct ci_req *ci_req = container_of(req, struct ci_req, req);
|
struct ci_req *ci_req = container_of(req, struct ci_req, req);
|
||||||
int num;
|
int num = -1;
|
||||||
|
|
||||||
|
if (ci_ep->desc)
|
||||||
|
num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
|
||||||
|
|
||||||
num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
|
|
||||||
if (num == 0) {
|
if (num == 0) {
|
||||||
if (!controller.ep0_req)
|
if (!controller.ep0_req)
|
||||||
return;
|
return;
|
||||||
|
Loading…
Reference in New Issue
Block a user