On Mon, Apr 30, 2018 at 11:20:53AM -0500, Bin Liu wrote:
musb_start_urb() doesn't check the pass-in parameter if it is NULL. But in musb_bulk_nak_timeout() the parameter passed to musb_start_urb() is returned from first_qh(), which could be NULL.
So wrap the musb_start_urb() call here with a if condition check to avoid the potential NULL pointer dereference.
Fixes: f283862f3b5cb("usb: musb: NAK timeout scheme on bulk TX endpoint")
Nit, you forgot a ' ', this should be: f283862f3b5c ("usb: musb: NAK timeout scheme on bulk TX endpoint")
You also had one extra id value in there, odd. I'll edit this by hand...
greg k-h