Merge "usb: gadget: f_mtp: Fix issue of NULL pointer access in mtp_read" into msm-4.8 (37bb4233) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/usb/gadget/function/f_mtp.c

+5 −4

Original line number	Diff line number	Diff line
		@@ -578,10 +578,6 @@ static ssize_t mtp_read(struct file fp, char __user buf,

		DBG(cdev, "mtp_read(%zu)\n", count);

		len = ALIGN(count, dev->ep_out->maxpacket);
		if (len > mtp_rx_req_len)
		return -EINVAL;

		/* we will block until we're online */
		DBG(cdev, "mtp_read: waiting for online state\n");
		ret = wait_event_interruptible(dev->read_wq,
		@@ -590,6 +586,11 @@ static ssize_t mtp_read(struct file fp, char __user buf,
		r = ret;
		goto done;
		}

		len = ALIGN(count, dev->ep_out->maxpacket);
		if (len > mtp_rx_req_len)
		return -EINVAL;

		spin_lock_irq(&dev->lock);
		if (dev->state == STATE_CANCELED) {
		/* report cancelation to userspace */