usb: dwc_otg_310: pcd: fix ep NULL pointer dereference in queue

err log:
Unable to handle kernel NULL pointer dereference at virtual address 00000011
pgd = c36f4000
[00000011] *pgd=00000000
Internal error: Oops: 5 [#1] PREEMPT SMP ARM
Modules linked in: mali rk30xxnand_ko(P)
CPU: 0 PID: 5270 Comm: FastMixer Tainted: P
task: db83b9c0 ti: cdf30000 task.ti: cdf30000
PC is at ep_queue+0x160/0x248
LR is at audio_send+0x21c/0x2ac
pc : [<c04eef2c>]    lr : [<c05181b4>]    psr: 600f0093
sp : cdf31e40  ip : 00000000  fp : 00200200
r10: c0cdab68  r9 : 00100100  r8 : 8d4fdf3b
r7 : 00000020  r6 : dea821d8  r5 : de99a000  r4 : d37d34c0
r3 : 000000b0  r2 : d7a7a600  r1 : 00000000  r0 : dea82000

Change-Id: I58ed928233acabc568689f9e9dc1f1fd2be28df0
Signed-off-by: Wu Liang feng <wulf@rock-chips.com>
This commit is contained in:
Wu Liang feng
2016-01-05 17:15:16 +08:00
committed by Tao Huang
parent f0d2f413f9
commit 2c7ae82487

View File

@@ -366,7 +366,8 @@ static int ep_queue(struct usb_ep *usb_ep, struct usb_request *usb_req,
/* In device DMA mode when gadget perform ep_queue request
* with buffer length 0, Kernel stack dump occurred. For 0
* length buffers perform dma_map_single() with length 4.*/
if (usb_req->dma == DWC_DMA_ADDR_INVALID) {
if (usb_req->dma == DWC_DMA_ADDR_INVALID &&
ep != NULL) {
dma_addr =
dma_map_single(gadget_wrapper->gadget.dev.parent,
usb_req->buf,
@@ -958,7 +959,8 @@ static int _complete(dwc_otg_pcd_t *pcd, void *ep_handle,
if (GET_CORE_IF(pcd)->dma_enable) {
/* if (req->length != 0) */
if (req->dma != DWC_DMA_ADDR_INVALID) {
if (req->dma != DWC_DMA_ADDR_INVALID &&
ep != NULL) {
dma_unmap_single(gadget_wrapper->gadget.dev.parent,
req->dma,
req->length !=