Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3bbd8980 authored by Jiebing Li's avatar Jiebing Li Committed by Dmitry Shmidt
Browse files

ANDROID: usb: gadget: fix NULL pointer issue in mtp_read() 



pointer dev->ep_out->desc is set to NULL if MTP function
is disabled during read operation. So we need to do pointer check
before access it and add spin lock protection in case it's modified
at another place in future.

Patchset: mtp

Change-Id: I96d3d685e93276c9065a1aa7b0cbbdc2e159aa6f
Signed-off-by: default avatarJiebing Li <jiebing.li@intel.com>
Signed-off-by: default avatarWang, Yu <yu.y.wang@intel.com>
Signed-off-by: default avatarRuss Weight <russell.h.weight@intel.com>
parent df5d3208

drivers/usb/gadget/function/f_mtp.c

+9 −5
Original line number Diff line number Diff line
@@ -541,14 +541,10 @@ static ssize_t mtp_read(struct file *fp, char __user *buf, 
	ssize_t r = count;

	unsigned xfer;

	int ret = 0;

	size_t len;

	size_t len = 0;



	DBG(cdev, "mtp_read(%zu)\n", count);



	len = usb_ep_align_maybe(cdev->gadget, dev->ep_out, count);

	if (len > MTP_BULK_BUFFER_SIZE)

		return -EINVAL;



	/* we will block until we're online */

	DBG(cdev, "mtp_read: waiting for online state\n");

	ret = wait_event_interruptible(dev->read_wq,
@@ -558,6 +554,14 @@ static ssize_t mtp_read(struct file *fp, char __user *buf, 
		goto done;

	}

	spin_lock_irq(&dev->lock);

	if (dev->ep_out->desc) {

		len = usb_ep_align_maybe(cdev->gadget, dev->ep_out, count);

		if (len > MTP_BULK_BUFFER_SIZE) {

			spin_unlock_irq(&dev->lock);

			return -EINVAL;

		}

	}



	if (dev->state == STATE_CANCELED) {

		/* report cancelation to userspace */

		dev->state = STATE_READY;