* [PATCH] usb: dwc3: Check that the request is valid in dwc3_gadget_giveback()
@ 2020-02-14 12:23 Vignesh Raghavendra
2020-02-14 18:33 ` Marek Vasut
0 siblings, 1 reply; 3+ messages in thread
From: Vignesh Raghavendra @ 2020-02-14 12:23 UTC (permalink / raw)
To: u-boot
From: Jean-Jacques Hiblot <jjhiblot@ti.com>
This fixes potential issues reported by klokworks:
Pointer 'req' returned from call to function 'next_request' at line 531 and
538 may be NULL and will be dereferenced in dwc3_gadget_giveback()
Signed-off-by: Jean-Jacques Hiblot <jjhiblot@ti.com>
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
---
drivers/usb/dwc3/gadget.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 4353dffb6b12..12de3b1da663 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -227,6 +227,9 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
{
struct dwc3 *dwc = dep->dwc;
+ if (!req)
+ return;
+
if (req->queued) {
dep->busy_slot++;
/*
--
2.25.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH] usb: dwc3: Check that the request is valid in dwc3_gadget_giveback()
2020-02-14 12:23 [PATCH] usb: dwc3: Check that the request is valid in dwc3_gadget_giveback() Vignesh Raghavendra
@ 2020-02-14 18:33 ` Marek Vasut
2020-02-17 4:34 ` Vignesh Raghavendra
0 siblings, 1 reply; 3+ messages in thread
From: Marek Vasut @ 2020-02-14 18:33 UTC (permalink / raw)
To: u-boot
On 2/14/20 1:23 PM, Vignesh Raghavendra wrote:
> From: Jean-Jacques Hiblot <jjhiblot@ti.com>
>
> This fixes potential issues reported by klokworks:
> Pointer 'req' returned from call to function 'next_request' at line 531 and
> 538 may be NULL and will be dereferenced in dwc3_gadget_giveback()
Shouldn't you rather handle the issue in dwc3_remove_requests() ?
Also, please explain what conditions trigger this issue, i.e. when req
becomes NULL.
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] usb: dwc3: Check that the request is valid in dwc3_gadget_giveback()
2020-02-14 18:33 ` Marek Vasut
@ 2020-02-17 4:34 ` Vignesh Raghavendra
0 siblings, 0 replies; 3+ messages in thread
From: Vignesh Raghavendra @ 2020-02-17 4:34 UTC (permalink / raw)
To: u-boot
On 15/02/20 12:03 am, Marek Vasut wrote:
> On 2/14/20 1:23 PM, Vignesh Raghavendra wrote:
>> From: Jean-Jacques Hiblot <jjhiblot@ti.com>
>>
>> This fixes potential issues reported by klokworks:
>> Pointer 'req' returned from call to function 'next_request' at line 531 and
>> 538 may be NULL and will be dereferenced in dwc3_gadget_giveback()
>
> Shouldn't you rather handle the issue in dwc3_remove_requests() ?
> Also, please explain what conditions trigger this issue, i.e. when req
> becomes NULL.
>
There is already a check for list_empty() before calling next_request()
in dwc3_remove_requests() which makes sure that 'req' will not be NULL.
So this report is a false positive.
Please ignore the patch.. Sorry for the trouble
--
Regards
Vignesh
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-02-17 4:34 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-02-14 12:23 [PATCH] usb: dwc3: Check that the request is valid in dwc3_gadget_giveback() Vignesh Raghavendra
2020-02-14 18:33 ` Marek Vasut
2020-02-17 4:34 ` Vignesh Raghavendra
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.