averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

usb: cdns3: gadget: fix NULL pointer dereference in ep_queue

Browse Source 
commit 7f6f127b9b upstream.

When the gadget endpoint is disabled or not yet configured, the ep->desc
pointer can be NULL. This leads to a NULL pointer dereference when
__cdns3_gadget_ep_queue() is called, causing a kernel crash.

Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the
standard return code for unconfigured endpoints.

This prevents potential crashes when ep_queue is called on endpoints
that are not ready.

Fixes: 7733f6c32e ("usb: cdns3: Add Cadence USB3 DRD Driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Yongchao Wu <yongchao.wu@autochips.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://patch.msgid.link/20260331000407.613298-1-yongchao.wu@autochips.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Yongchao Wu
2026-04-11 14:19:30 +02:00
committed by Greg Kroah-Hartman
parent beab104294
commit 9ab9b0e5fc
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/usb/cdns3/cdns3-gadget.c
+3
View File
@@ -2588,6 +2588,9 @@ static int __cdns3_gadget_ep_queue(struct usb_ep *ep,
struct cdns3_request *priv_req;
int ret = 0;
if (!ep->desc)
return -ESHUTDOWN;
request->actual = 0;
request->status = -EINPROGRESS;
priv_req = to_cdns3_request(request);