Commit 7df933d7 authored Aug 06, 2020 by Ajay Agarwal Committed by Rohith Kollalsi Aug 25, 2020

usb: gadget: u_ether: Add skb check in eth_start_xmit



'Commit 145c3d9be206 ("usb: u_ether: Prevent dropping multicast
packet in rmnet ip mode")' removed skb check from eth_start_xmit
function. While ndo_start_xmit are typically expected never to be
called with NULL SKBs, for NCM function this xmit function is
called with NULL SKB initially which then uses the 'wrap' routine
to create valid SKBs. But this null SKB is getting dereferenced
before 'wrap' routine could run on it when in ethernet mode.
Fix this by bringing in the skb check.

Change-Id: I9d40f70190eb91ecc848b71c4ce31a656c60a28d
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>

parent 0afd6cbe

drivers/usb/gadget/function/u_ether.c

+10 −10

Original line number	Diff line number	Diff line
		@@ -490,7 +490,7 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
		}
		spin_unlock_irqrestore(&dev->lock, flags);

		if (!in) {
		if (skb && !in) {
		dev_kfree_skb_any(skb);
		return NETDEV_TX_OK;
		}
		@@ -547,6 +547,7 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
		if (dev->port_usb)
		skb = dev->wrap(dev->port_usb, skb);
		spin_unlock_irqrestore(&dev->lock, flags);
		}
		if (!skb) {
		/* Multi frame CDC protocols may store the frame for
		* later which is not a dropped frame.
		@@ -556,7 +557,6 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
		goto multiframe;
		goto drop;
		}
		}

		length = skb->len;
		req->buf = skb->data;