From 1f54025d70c4c9e6ec8d82d8b69b0d66a7bbbdc1 Mon Sep 17 00:00:00 2001
From: Marek Vasut <marex@denx.de>
Date: Fri, 28 Jan 2022 04:39:09 +0100
Subject: [PATCH] usb: gadget: ci: Avoid null pointer dereference

The ci_req->hw_buf can be NULL, test whether it is and if so,
avoid accessing it. Else, the system may crash.

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Peter Chen <peter.chen@nxp.com>
Cc: Li Jun <jun.li@nxp.com>
Cc: Peng Fan <peng.fan@nxp.com>
---
 drivers/usb/gadget/ci_udc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/ci_udc.c b/drivers/usb/gadget/ci_udc.c
index 226a9e6d67..542684c1c3 100644
--- a/drivers/usb/gadget/ci_udc.c
+++ b/drivers/usb/gadget/ci_udc.c
@@ -402,6 +402,9 @@ align:
 
 flush:
 	hwaddr = (unsigned long)ci_req->hw_buf;
+	if (!hwaddr)
+		return 0;
+
 	aligned_used_len = roundup(req->length, ARCH_DMA_MINALIGN);
 	flush_dcache_range(hwaddr, hwaddr + aligned_used_len);
 
@@ -415,7 +418,7 @@ static void ci_debounce(struct ci_req *ci_req, int in)
 	unsigned long hwaddr = (unsigned long)ci_req->hw_buf;
 	uint32_t aligned_used_len;
 
-	if (in)
+	if (in || !hwaddr)
 		return;
 
 	aligned_used_len = roundup(req->actual, ARCH_DMA_MINALIGN);
-- 
2.39.5