[lvc-project] [PATCH] usb: tegra-xudc: check ep->desc before dereferencing

[Alexey V. Vissarionov]

Good ${greeting_time}!

On 2025-04-16 08:43:58 +0100, Jon Hunter wrote:

 >> Check ep->desc before dereferencing it in tegra_xudc_req_done()
 >> --- a/drivers/usb/gadget/udc/tegra-xudc.c
 >> +++ b/drivers/usb/gadget/udc/tegra-xudc.c
 >> @@ -2661,6 +2661,10 @@ static void
 >> tegra_xudc_handle_transfer_completion(struct tegra_xudc *xudc,
 >>	trb = trb_phys_to_virt(ep, trb_read_data_ptr(event));
 >>	req = trb_to_request(ep, trb);
 >>
 >> +	/* tegra_xudc_req_done() dereferences ep->desc; check it
 >> here */
 >> +	if (!ep || !ep->desc)
 >> +		return;
 >> +
 > Looking at the code, it would seem that we should check !ep at
 > the start of the function, because it has already been used at
 > this point. Also !ep is worthy of an error message because that
 > should never happen.

Agree, the check should be performed before trb_phys_to_virt() and,
possibly, there should be two separate checks.

Any suggestions on a error message?
  dev_err(xudc->dev, "Unbelievable: ep is NULL\n");
(and same for ep->desc) looks ok for me. Or s/Unbelieva/Impossi/ ?

Next version of the patch follows.


-- 
Alexey V. Vissarionov
gremlin ПРИ altlinux ТЧК org; +vii-cmiii-ccxxix-lxxix-xlii
GPG: 0D92F19E1C0DC36E27F61A29CD17E2B43D879005 @ hkp://keys.gnupg.net