| Message ID | 1415652309-30959-1-git-send-email-balbi@ti.com |
|---|---|
| State | Accepted |
| Commit | 520fe7633692181bb6d1560d655fbdfbb7c05aaa |
| Headers | show |
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c index 711b230..df38e7e 100644 --- a/drivers/usb/dwc3/ep0.c +++ b/drivers/usb/dwc3/ep0.c @@ -791,6 +791,10 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc, trb = dwc->ep0_trb; + r = next_request(&ep0->request_list); + if (!r) + return; + status = DWC3_TRB_SIZE_TRBSTS(trb->size); if (status == DWC3_TRBSTS_SETUP_PENDING) { dwc3_trace(trace_dwc3_ep0, "Setup Pending received"); @@ -801,10 +805,6 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc, return; } - r = next_request(&ep0->request_list); - if (!r) - return; - ur = &r->request; length = trb->size & DWC3_TRB_SIZE_MASK;
commit 6856d30 (usb: dwc3: ep0: return early on NULL requests) tried to fix a minor corner case where we could dereference a NULL pointer but it also ended up introducing some dead code. Unfortunately, that dead code, if reached, could end up starving the endpoint request list because a request would never be given back when it should. Fix this by moving the check for empty request list before its first use. Reported-by: Dave Jones <davej@redhat.com> Signed-off-by: Felipe Balbi <balbi@ti.com> --- drivers/usb/dwc3/ep0.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)