Commit d8682453 authored Jan 28, 2013 by Rajkumar Raghupathy Committed by Gerrit - the friendly Code Review server Mar 07, 2018

USB: u_ether: Check if port_usb is NULL before accessing



Rndis tx requests are queued to the controller, while disconnect
is in progress. There is a chance of getting the completion of
those requests after dev->port_usb is set to NULL. This leads to
NULL pointer dereference in tx_complete().

Hence, check if dev->port_usb is NULL before accessing it
in tx_complete() and free the current request accordingly.

Change-Id: I42a427f7e51ffe4f81768756d835d123778df260
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>

parent 14681b57

drivers/usb/gadget/function/u_ether.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -511,6 +511,11 @@ static void tx_complete(struct usb_ep ep, struct usb_request req)
		int length;
		int retval;

		if (!dev->port_usb) {
		usb_ep_free_request(ep, req);
		return;
		}

		switch (req->status) {
		default:
		dev->net->stats.tx_errors++;