Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
Date:   Mon, 31 Aug 2020 20:33:09 +0300
From:   lutovinova@ispras.ru
To:     peter.senna@gmail.com
Cc:     martin.donnelly@ge.com, martyn.welch@collabora.co.uk,
        a.hajda@samsung.com, narmstrong@baylibre.com,
        Laurent.pinchart@ideasonboard.com, jonas@kwiboo.se,
        jernej.skrabec@siol.net, airlied@linux.ie, daniel@ffwll.ch,
        dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
        ldv-project@linuxtesting.org, lutovinova@ispras.ru
Subject: fotg210-udc: Error in type cast in fotg210_in_fifo_handler()
User-Agent: Roundcube Webmail/1.4.4
Message-ID: <b8b01720ee550840c7c0fc39d3e9e5f9@ispras.ru>
Content-Type: text/plain; charset=US-ASCII;
 format=flowed
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

If in fotg210_udc_probe() after initialization 
INIT_LIST_HEAD(&ep->queue)
and after a registration of an interrupt handler in fotg210_irq()
fotg210_in_fifo_handler() is calling then in fotg210_in_fifo_handler()
list_entry() tries to get struct fotg210_request from ep->queue.next, 
but
after initialization ep->queue.next is from struct fotg210_udc.

Also this problem appears in  fotg210_out_fifo_handler().

In fotg210_ep0in() and fotg210_ep0out()
there is checking by list_empty() before calling list_entry ().

Found by Linux Driver Verification project (linuxtesting.org).