hc
2024-05-10 9999e48639b3cecb08ffb37358bcba3b48161b29
kernel/drivers/usb/gadget/udc/fsl_qe_udc.c
....@@ -923,9 +923,9 @@
923923 return 0;
924924 }
925925
926
-static void ep_rx_tasklet(unsigned long data)
926
+static void ep_rx_tasklet(struct tasklet_struct *t)
927927 {
928
- struct qe_udc *udc = (struct qe_udc *)data;
928
+ struct qe_udc *udc = from_tasklet(udc, t, rx_tasklet);
929929 struct qe_ep *ep;
930930 struct qe_frame *pframe;
931931 struct qe_bd __iomem *bd;
....@@ -1950,8 +1950,12 @@
19501950 } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
19511951 /* Get endpoint status */
19521952 int pipe = index & USB_ENDPOINT_NUMBER_MASK;
1953
- struct qe_ep *target_ep = &udc->eps[pipe];
1953
+ struct qe_ep *target_ep;
19541954 u16 usep;
1955
+
1956
+ if (pipe >= USB_MAX_ENDPOINTS)
1957
+ goto stall;
1958
+ target_ep = &udc->eps[pipe];
19551959
19561960 /* stall if endpoint doesn't exist */
19571961 if (!target_ep->ep.desc)
....@@ -2553,8 +2557,7 @@
25532557 DMA_TO_DEVICE);
25542558 }
25552559
2556
- tasklet_init(&udc->rx_tasklet, ep_rx_tasklet,
2557
- (unsigned long)udc);
2560
+ tasklet_setup(&udc->rx_tasklet, ep_rx_tasklet);
25582561 /* request irq and disable DR */
25592562 udc->usb_irq = irq_of_parse_and_map(np, 0);
25602563 if (!udc->usb_irq) {