[PATCH] usb: dwc3: gadget: fix crash in dwc3_gadget_giveback()
Neil Armstrong
neil.armstrong at linaro.org
Tue May 28 10:35:03 CEST 2024
If the ep0 stalls or request are dequeued when gagdet is stopped,
the request dma may not be mapped yet and dwc3_flush_cache() may be
called with a NULL pointer.
Check req->request.dma before calling dwc3_flush_cache() and later
the usb_gadget_unmap_request() functions since it means that
usb_gadget_map_request() hasn't been called yet.
Fixes: fd15b58c1a9 ("dwc3: flush cache only if there is a buffer attached to a request")
Signed-off-by: Neil Armstrong <neil.armstrong at linaro.org>
---
drivers/usb/dwc3/gadget.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index fab32575647..92c7c6d08b7 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -248,7 +248,7 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
list_del(&req->list);
req->trb = NULL;
- if (req->request.length)
+ if (req->request.dma && req->request.length)
dwc3_flush_cache((uintptr_t)req->request.dma, req->request.length);
if (req->request.status == -EINPROGRESS)
@@ -256,7 +256,7 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
if (dwc->ep0_bounced && dep->number == 0)
dwc->ep0_bounced = false;
- else
+ else if (req->request.dma)
usb_gadget_unmap_request(&dwc->gadget, &req->request,
req->direction);
---
base-commit: 7e52d6ccfb76e2afc2d183b357abe2a2e2f948cf
change-id: 20240528-topic-sm8x50-dwc3-gadget-crash-fix-fa0404ffce33
Best regards,
--
Neil Armstrong <neil.armstrong at linaro.org>
More information about the U-Boot
mailing list