Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit baa169be authored by Liangliang Lu's avatar Liangliang Lu Committed by Pratham Pratap
Browse files

usb: gadget: Add check gadget function bind or not 



For NCM gadget function, net device structure opts->net
will be freed when NCM unbind, but user space related
device node doesn't know it, will access net structre
without checking it exist or not, finally lead to crash.

Fix this by adding check gadget function bind or not.

Change-Id: I6af9e3868f71e7fa923600721e1f716508de9b55
Signed-off-by: default avatarLiangliang Lu <luliang@codeaurora.org>
parent 0a1aee54

drivers/usb/gadget/function/f_ncm.c

+2 −1
Original line number Diff line number Diff line
@@ -1706,6 +1706,8 @@ static void ncm_unbind(struct usb_configuration *c, struct usb_function *f) 


	DBG(c->cdev, "ncm unbind\n");



	opts->bound = false;



	hrtimer_cancel(&ncm->task_timer);

	tasklet_kill(&ncm->tx_tasklet);
@@ -1716,7 +1718,6 @@ static void ncm_unbind(struct usb_configuration *c, struct usb_function *f) 
	usb_ep_free_request(ncm->notify, ncm->notify_req);



	gether_cleanup(netdev_priv(opts->net));

	opts->bound = false;

}



static struct usb_function *ncm_alloc(struct usb_function_instance *fi)

drivers/usb/gadget/function/u_ether_configfs.h

+35 −0
Original line number Diff line number Diff line
@@ -35,6 +35,11 @@ 
		struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item);	\

		int result;						\

									\

		if (opts->bound == false) {		\

			pr_err("Gadget function do not bind yet.\n");	\

			return -ENODEV;			\

		}							\

									\

		mutex_lock(&opts->lock);				\

		result = gether_get_dev_addr(opts->net, page, PAGE_SIZE); \

		mutex_unlock(&opts->lock);				\
@@ -48,6 +53,11 @@ 
		struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item);	\

		int ret;						\

									\

		if (opts->bound == false) {		\

			pr_err("Gadget function do not bind yet.\n");	\

			return -ENODEV;			\

		}							\

									\

		mutex_lock(&opts->lock);				\

		if (opts->refcnt) {					\

			mutex_unlock(&opts->lock);			\
@@ -70,6 +80,11 @@ 
		struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item);	\

		int result;						\

									\

		if (opts->bound == false) {		\

			pr_err("Gadget function do not bind yet.\n");	\

			return -ENODEV;			\

		}							\

									\

		mutex_lock(&opts->lock);				\

		result = gether_get_host_addr(opts->net, page, PAGE_SIZE); \

		mutex_unlock(&opts->lock);				\
@@ -83,6 +98,11 @@ 
		struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item);	\

		int ret;						\

									\

		if (opts->bound == false) {		\

			pr_err("Gadget function do not bind yet.\n");	\

			return -ENODEV;			\

		}							\

									\

		mutex_lock(&opts->lock);				\

		if (opts->refcnt) {					\

			mutex_unlock(&opts->lock);			\
@@ -105,6 +125,11 @@ 
		struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item);	\

		unsigned qmult;						\

									\

		if (opts->bound == false) {		\

			pr_err("Gadget function do not bind yet.\n");	\

			return -ENODEV;			\

		}							\

									\

		mutex_lock(&opts->lock);				\

		qmult = gether_get_qmult(opts->net);			\

		mutex_unlock(&opts->lock);				\
@@ -118,6 +143,11 @@ 
		u8 val;							\

		int ret;						\

									\

		if (opts->bound == false) {		\

			pr_err("Gadget function do not bind yet.\n");	\

			return -ENODEV;			\

		}							\

									\

		mutex_lock(&opts->lock);				\

		if (opts->refcnt) {					\

			ret = -EBUSY;					\
@@ -144,6 +174,11 @@ out: \ 
		struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item);	\

		int ret;						\

									\

		if (opts->bound == false) {		\

			pr_err("Gadget function do not bind yet.\n");	\

			return -ENODEV;			\

		}							\

									\

		mutex_lock(&opts->lock);				\

		ret = gether_get_ifname(opts->net, page, PAGE_SIZE);	\

		mutex_unlock(&opts->lock);				\