Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 02f336ce authored by Phil Elwell's avatar Phil Elwell Committed by Greg Kroah-Hartman
Browse files

usb: gadget: f_hid: fixed NULL pointer dereference 

commit 2867652e4766360adf14dfda3832455e04964f2a upstream.

Disconnecting and reconnecting the USB cable can lead to crashes
and a variety of kernel log spam.

The problem was found and reproduced on the Raspberry Pi [1]
and the original fix was created in Raspberry's own fork [2].

Link: https://github.com/raspberrypi/linux/issues/3870 [1]
Link: https://github.com/raspberrypi/linux/commit/a6e47d5f4efbd2ea6a0b6565cd2f9b7bb217ded5

 [2]
Signed-off-by: default avatarMaxim Devaev <mdevaev@gmail.com>
Signed-off-by: default avatarPhil Elwell <phil@raspberrypi.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210723155928.210019-1-mdevaev@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f780a958

drivers/usb/gadget/function/f_hid.c

+20 −6
Original line number Diff line number Diff line
@@ -345,6 +345,11 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, 


	spin_lock_irqsave(&hidg->write_spinlock, flags);



	if (!hidg->req) {

		spin_unlock_irqrestore(&hidg->write_spinlock, flags);

		return -ESHUTDOWN;

	}



#define WRITE_COND (!hidg->write_pending)

try_again:

	/* write queue */
@@ -365,8 +370,14 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, 
	count  = min_t(unsigned, count, hidg->report_length);



	spin_unlock_irqrestore(&hidg->write_spinlock, flags);

	status = copy_from_user(req->buf, buffer, count);



	if (!req) {

		ERROR(hidg->func.config->cdev, "hidg->req is NULL\n");

		status = -ESHUTDOWN;

		goto release_write_pending;

	}



	status = copy_from_user(req->buf, buffer, count);

	if (status != 0) {

		ERROR(hidg->func.config->cdev,

			"copy_from_user error\n");
@@ -394,14 +405,17 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, 


	spin_unlock_irqrestore(&hidg->write_spinlock, flags);



	if (!hidg->in_ep->enabled) {

		ERROR(hidg->func.config->cdev, "in_ep is disabled\n");

		status = -ESHUTDOWN;

		goto release_write_pending;

	}



	status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC);

	if (status < 0) {

		ERROR(hidg->func.config->cdev,

			"usb_ep_queue error on int endpoint %zd\n", status);

	if (status < 0)

		goto release_write_pending;

	} else {

	else

		status = count;

	}



	return status;

release_write_pending: