Skip to content

drivers: usb: udc: Added check for NULL ep_cfg #106846

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
stites-infineon wants to merge 1 commit into from
Closed

drivers: usb: udc: Added check for NULL ep_cfg #106846

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 41 additions & 3 deletions drivers/usb/udc/udc_dwc2.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -836,6 +836,11 @@ static inline int dwc2_handle_evt_dout(const struct device *dev,
struct net_buf *buf;
int err = 0;

if (cfg == NULL) {
LOG_ERR("No ep_cfg for DOUT event");
return -ENODEV;
}

Comment on lines +839 to +843
Copy link
Copy Markdown
Contributor

@jfischer-no jfischer-no Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This driver assumes endpoints are always initialized.

They should be, there must be something else wrong with your quirks/porting.

Copy link
Copy Markdown
Contributor Author

@stites-infineon stites-infineon Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah okay, thank you for clarifying. I'll debug my device support update then to see why they aren't. Closing this

buf = udc_buf_get(cfg);
if (buf == NULL) {
LOG_ERR("No buffer queued for ep 0x%02x", cfg->addr);
Expand All @@ -858,6 +863,11 @@ static int dwc2_handle_evt_din(const struct device *dev,
{
struct net_buf *buf;

if (cfg == NULL) {
LOG_ERR("No ep_cfg for DIN event");
return -ENODEV;
}

buf = udc_buf_peek(cfg);
if (buf == NULL) {
LOG_ERR("No buffer for ep 0x%02x", cfg->addr);
Expand Down Expand Up @@ -1176,6 +1186,14 @@ static void dwc2_unset_unused_fifo(const struct device *dev)
for (uint8_t i = priv->ineps - 1U; i > 0; i--) {
tmp = udc_get_ep_cfg(dev, i | USB_EP_DIR_IN);

if (tmp == NULL) {
/* No ep_cfg registered for this IN endpoint index;
* clear any stale txf_set bit and continue.
*/
priv->txf_set &= ~BIT(i);
continue;
}

if (tmp->stat.enabled && (priv->txf_set & BIT(i))) {
return;
}
Expand Down Expand Up @@ -2465,9 +2483,8 @@ static inline void dwc2_handle_rxflvl(const struct device *dev)
case USB_DWC2_GRXSTSR_PKTSTS_OUT_DATA:
ep_cfg = udc_get_ep_cfg(dev, ep);

buf = udc_buf_peek(ep_cfg);

/* RxFIFO data must be retrieved even when buf is NULL */
/* RxFIFO data must be retrieved even when ep_cfg or buf is NULL */
buf = (ep_cfg != NULL) ? udc_buf_peek(ep_cfg) : NULL;
dwc2_read_fifo(dev, ep, buf, bcnt);
break;
case USB_DWC2_GRXSTSR_PKTSTS_OUT_DATA_DONE:
Expand All @@ -2492,6 +2509,11 @@ static inline void dwc2_handle_in_xfercompl(const struct device *dev,
struct net_buf *buf;

ep_cfg = udc_get_ep_cfg(dev, ep_idx | USB_EP_DIR_IN);
if (ep_cfg == NULL) {
LOG_ERR("No ep_cfg for IN ep 0x%02x", ep_idx | USB_EP_DIR_IN);
return;
}

buf = udc_buf_peek(ep_cfg);
if (buf == NULL) {
udc_submit_event(dev, UDC_EVT_ERROR, -ENOBUFS);
Expand Down Expand Up @@ -2601,6 +2623,12 @@ static inline void dwc2_handle_out_xfercompl(const struct device *dev,
uint32_t bcnt;
struct net_buf *buf;
uint32_t doeptsiz;

if (!ep_cfg) {
LOG_ERR("No ep_cfg for OUT ep 0x%02x", ep_idx);
return;
}

const bool is_iso = dwc2_ep_is_iso(ep_cfg);

doeptsiz = sys_read32((mem_addr_t)&base->out_ep[ep_idx].doeptsiz);
Expand Down Expand Up @@ -3167,6 +3195,11 @@ static ALWAYS_INLINE void dwc2_thread_handler(void *const arg)
ep = pull_next_ep_from_bitmap(&eps);
ep_cfg = udc_get_ep_cfg(dev, ep);

if (ep_cfg == NULL) {
LOG_ERR("No ep_cfg for xfer ep 0x%02x", ep);
continue;
}

if (!udc_ep_is_busy(ep_cfg)) {
dwc2_handle_xfer_next(dev, ep_cfg);
} else {
Expand All @@ -3189,6 +3222,11 @@ static ALWAYS_INLINE void dwc2_thread_handler(void *const arg)
ep = pull_next_ep_from_bitmap(&eps);
ep_cfg = udc_get_ep_cfg(dev, ep);

if (ep_cfg == NULL) {
LOG_ERR("No ep_cfg for finished ep 0x%02x", ep);
continue;
}

if (USB_EP_DIR_IS_IN(ep)) {
LOG_DBG("DIN event ep 0x%02x", ep);
dwc2_handle_evt_din(dev, ep_cfg);
Expand Down
Loading