[PATCH] usb gadget: fix null pointer dereference

[Yang Ruirui <ruirui.r.yang@xxxxxxxxx>]

Oops happen when gadget speed is USB_SPEED_HIGH, but there's no hs_descriptors 
see below code in drivers/usb/gadget/composite.c:

    	switch (gadget->speed) {
    	case USB_SPEED_SUPER:
    		descriptors = f->ss_descriptors;
    		break;
    	case USB_SPEED_HIGH:
    		descriptors = f->hs_descriptors;
    		break;
    	default:
    	descriptors = f->descriptors;
    	}
    
    	#### oops here
    	for (; *descriptors; ++descriptors) {
    	####
    
Here I got gadget->speed = USB_SPEED_HIGH but f->hs_descriptor = NULL
    
Fix it by setting the speed according to  the speed of config functions

Signed-off-by: Yang RuiRui <ruirui.r.yang@xxxxxxxxx>
---
 drivers/usb/gadget/composite.c |    9 +++++++++
 1 file changed, 9 insertions(+)

diff -uprN a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
--- a/drivers/usb/gadget/composite.c	2011-08-16 17:49:38.813038094 +0800
+++ b/drivers/usb/gadget/composite.c	2011-08-16 17:47:03.716372207 +0800
@@ -603,6 +603,7 @@ static int set_config(struct usb_composi
 	int			result = -EINVAL;
 	unsigned		power = gadget_is_otg(gadget) ? 8 : 100;
 	int			tmp;
+	enum usb_device_speed	s = USB_SPEED_LOW;
 
 	if (number) {
 		list_for_each_entry(c, &cdev->configs, list) {
@@ -626,6 +627,14 @@ static int set_config(struct usb_composi
 		result = 0;
 	}
 
+	if (c->fullspeed && (gadget->speed == USB_SPEED_FULL))
+		s = USB_SPEED_FULL;
+	if (c->highspeed && (gadget->speed == USB_SPEED_HIGH))
+		s = USB_SPEED_HIGH;
+	if (c->superspeed && (gadget->speed == USB_SPEED_SUPER))
+		s = USB_SPEED_SUPER;
+	gadget->speed = s;
+
 	INFO(cdev, "%s speed config #%d: %s\n",
 		({ char *speed;
 		switch (gadget->speed) {
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html