Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c06b99e0 authored by Christian Gromm's avatar Christian Gromm Committed by Greg Kroah-Hartman
Browse files

staging: most: usb: fix usb_disconnect race condition 



The functions usb_disconnect and usb_sndbulkpipe are racing for the struct
usb_device, which might cause a null pointer dereference exception. This
patch fixes this race condition by protecting the critical section inside
the function hdm_enque with the io_mutex.

Signed-off-by: default avatarChristian Gromm <christian.gromm@microchip.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9a32315b

drivers/staging/most/usb/usb.c

+13 −6
Original line number Diff line number Diff line
@@ -565,14 +565,19 @@ static int hdm_enqueue(struct most_interface *iface, int channel, 


	mdev = to_mdev(iface);

	conf = &mdev->conf[channel];

	dev = &mdev->usb_device->dev;



	if (!mdev->usb_device)

		return -ENODEV;

	mutex_lock(&mdev->io_mutex);

	if (!mdev->usb_device) {

		retval = -ENODEV;

		goto _exit;

	}



	dev = &mdev->usb_device->dev;

	urb = usb_alloc_urb(NO_ISOCHRONOUS_URB, GFP_ATOMIC);

	if (!urb)

		return -ENOMEM;

	if (!urb) {

		retval = -ENOMEM;

		goto _exit;

	}



	if ((conf->direction & MOST_CH_TX) && mdev->padding_active[channel] &&

	    hdm_add_padding(mdev, channel, mbo)) {
@@ -613,12 +618,14 @@ static int hdm_enqueue(struct most_interface *iface, int channel, 
		dev_err(dev, "URB submit failed with error %d.\n", retval);

		goto _error_1;

	}

	return 0;

	goto _exit;



_error_1:

	usb_unanchor_urb(urb);

_error:

	usb_free_urb(urb);

_exit:

	mutex_unlock(&mdev->io_mutex);

	return retval;

}