USB: musb: Fix null pointer dereference issue

This patch fixes the following NULL pointer dereference issue.

Pointer 'request' returned from call to function 'next_request'
at line 748 may be NULL and may be dereferenced at line 792.

============
Code Snippet
============

748:  request = next_request(musb_ep);
785: if (dma && (csr & MUSB_RXCSR_DMAENAB)) {
	csr &= ~(MUSB_RXCSR_AUTOCLEAR
			| MUSB_RXCSR_DMAENAB
			| MUSB_RXCSR_DMAMODE);
	musb_writew(epio, MUSB_RXCSR,
		MUSB_RXCSR_P_WZC_BITS | csr);

792:	 request->actual += musb_ep->dma->actual_len;

Signed-off-by: Maulik Mankad <[email protected]>
Cc: Felipe Balbi <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index ac306985a8a1f2c00bd8c86609e10defcf262700..cbcf14a236e6e3a19e80bfcd8e19af257ce5a727 100644 (file)
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -746,6 +746,8 @@ void musb_g_rx(struct musb *musb, u8 epnum)
        musb_ep_select(mbase, epnum);
 
        request = next_request(musb_ep);
+       if (!request)
+               return;
 
        csr = musb_readw(epio, MUSB_RXCSR);
        dma = is_dma_capable() ? musb_ep->dma : NULL;