Re: [PATCH] usb: cdns3: gadget: fix NULL pointer dereference in ep_queue

[Peter Chen (CIX)]

On 26-03-29 09:34:04, Yongchao Wu wrote:
> When the gadget endpoint is disabled or not yet configured, the ep->desc
> pointer can be NULL. This leads to a NULL pointer dereference when
> __cdns3_gadget_ep_queue() is called, causing a kernel crash.
> 
> Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the
> standard return code for unconfigured endpoints.
> 
> This prevents potential crashes when ep_queue is called on endpoints
> that are not ready.
> 
> Signed-off-by: Yongchao Wu  <yongchao.wu@xxxxxxxxxxxxx>

Add Fixed-by tag and Cc to stable tree please, others:

Acked-by: Peter Chen <peter.chen@xxxxxxxxxx>

Peter
> ---
>  drivers/usb/cdns3/cdns3-gadget.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
> index d59a60a16..96d2a4c38 100644
> --- a/drivers/usb/cdns3/cdns3-gadget.c
> +++ b/drivers/usb/cdns3/cdns3-gadget.c
> @@ -2589,6 +2589,9 @@ static int __cdns3_gadget_ep_queue(struct usb_ep *ep,
>  	struct cdns3_request *priv_req;
>  	int ret = 0;
>  
> +	if (!ep->desc)
> +		return -ESHUTDOWN;
> +
>  	request->actual = 0;
>  	request->status = -EINPROGRESS;
>  	priv_req = to_cdns3_request(request);
> -- 
> 2.43.0
> 
> 

-- 

Best regards,
Peter