From 108c841217974da6e7d9197e404c27dbeeaa8641 Mon Sep 17 00:00:00 2001 From: Hemant Kumar Date: Wed, 19 Sep 2018 11:34:48 -0700 Subject: [PATCH] usb: gadget: u_audio: Check return value from config_ep_by_speed() In case config_ep_by_speed() returns error, endpoint descriptors would not get populated. This results into NULL pointer dereference when ep desc is accessed later. Fix this by bailing out set_alt if config_ep_by_speed() API returns error. Change-Id: Iaf9a0001973753988ff200edad3ed8587b6a4181 Signed-off-by: Hemant Kumar Signed-off-by: Ajay Agarwal --- drivers/usb/gadget/function/u_audio.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c index d3a639297e06..435f0614d572 100644 --- a/drivers/usb/gadget/function/u_audio.c +++ b/drivers/usb/gadget/function/u_audio.c @@ -380,11 +380,14 @@ int u_audio_start_capture(struct g_audio *audio_dev) struct usb_ep *ep; struct uac_rtd_params *prm; struct uac_params *params = &audio_dev->params; - int req_len, i; + int req_len, i, ret; ep = audio_dev->out_ep; prm = &uac->c_prm; - config_ep_by_speed(gadget, &audio_dev->func, ep); + ret = config_ep_by_speed(gadget, &audio_dev->func, ep); + if (ret) + return ret; + req_len = prm->max_psize; prm->ep_enabled = true; @@ -433,11 +436,13 @@ int u_audio_start_playback(struct g_audio *audio_dev) struct uac_params *params = &audio_dev->params; unsigned int factor, rate; const struct usb_endpoint_descriptor *ep_desc; - int req_len, i; + int req_len, i, ret; ep = audio_dev->in_ep; prm = &uac->p_prm; - config_ep_by_speed(gadget, &audio_dev->func, ep); + ret = config_ep_by_speed(gadget, &audio_dev->func, ep); + if (ret) + return ret; ep_desc = ep->desc; -- 2.11.0