usb: dwc3: gadget: Iterate only over valid endpoints

Make dwc3_gadget_resize_tx_fifos() iterate only over IN
endpoints that are actually present, based on the
num_in_eps parameter. This terminates the loop so as to
prevent dereferencing a potential NULL dwc->eps[i] where
i >= (num_in_eps + num_out_eps).

Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index a740eac74d56d502675107f03ffbd324e85f1f63..70715eeededda3b4acfab6bff72f13531338a8b2 100644 (file)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -187,15 +187,12 @@ int dwc3_gadget_resize_tx_fifos(struct dwc3 *dwc)
         * improve this algorithm so that we better use the internal
         * FIFO space
         */
-       for (num = 0; num < DWC3_ENDPOINTS_NUM; num++) {
-               struct dwc3_ep  *dep = dwc->eps[num];
-               int             fifo_number = dep->number >> 1;
+       for (num = 0; num < dwc->num_in_eps; num++) {
+               /* bit0 indicates direction; 1 means IN ep */
+               struct dwc3_ep  *dep = dwc->eps[(num << 1) | 1];
                int             mult = 1;
                int             tmp;
 
-               if (!(dep->number & 1))
-                       continue;
-
                if (!(dep->flags & DWC3_EP_ENABLED))
                        continue;
 
@@ -224,8 +221,7 @@ int dwc3_gadget_resize_tx_fifos(struct dwc3 *dwc)
                dev_vdbg(dwc->dev, "%s: Fifo Addr %04x Size %d\n",
                                dep->name, last_fifo_depth, fifo_size & 0xffff);
 
-               dwc3_writel(dwc->regs, DWC3_GTXFIFOSIZ(fifo_number),
-                               fifo_size);
+               dwc3_writel(dwc->regs, DWC3_GTXFIFOSIZ(num), fifo_size);
 
                last_fifo_depth += (fifo_size & 0xffff);
        }