[PATCH] usb: gadget: f_midi2: Fix null dereference

[Michail Tatas]

#syz test

f_midi2_bind only binds if
if (... != SNDRV_UMP_DIR_OUTPUT)
...
if (... != SNDRV_UMP_DIR_INPUT)
...

When f_midi2_set_alt gets called, it uncoditionally calls
f_midi2_stop_eps which triggers a null dereference in
f_midi2_free_ep_reqs

Add guard to catch dereference in f_midi2_free_ep_reqs like
f_midi2_drop_reqs already has

Signed-off-by: Michail Tatas <michai...@gmail.com>
---
drivers/usb/gadget/function/f_midi2.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/usb/gadget/function/f_midi2.c b/drivers/usb/gadget/function/f_midi2.c
index 19fdac024343..b84f2c220b2e 100644
--- a/drivers/usb/gadget/function/f_midi2.c
+++ b/drivers/usb/gadget/function/f_midi2.c
@@ -1163,6 +1163,9 @@ static void f_midi2_free_ep_reqs(struct f_midi2_usb_ep *usb_ep)
struct f_midi2 *midi2 = usb_ep->card;
int i;

+ if (!usb_ep->usb_ep || !usb_ep->num_reqs)
+ return;
+
for (i = 0; i < midi2->info.num_reqs; i++) {
if (!usb_ep->reqs[i].req)
continue;
--
2.43.0