Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2e03c394 authored by Vijayavardhan Vennapusa's avatar Vijayavardhan Vennapusa Committed by Hemant Kumar
Browse files

USB: composite: Check return value before composite_setup_complete() 



Currently driver is calling composite_setup_complete() when request
queuing to control endpoint fails. During disconnect or composition switch,
ep_queue() fails with -ESHUTDOWN return value. In this case also, driver is
calling composite_setup_complete(), which leads to invalid pointer
dereference. Fix it by not calling composite_setup_complete() in case of
return value of -ESHUTDOWN as anyhow composite_unbind() will take care of
clearing pending flags before freeing request buffers.

Change-Id: I87ea6ecb1e925c6b36dede59486e49ba3a4e90c7
Signed-off-by: default avatarVijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: default avatarJack Pham <jackp@codeaurora.org>
Signed-off-by: default avatarHemant Kumar <hemantk@codeaurora.org>
parent c9ac60dd

drivers/usb/gadget/composite.c

+2 −1
Original line number Diff line number Diff line
@@ -2069,6 +2069,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) 
		if (value < 0) {

			DBG(cdev, "ep_queue --> %d\n", value);

			req->status = 0;

			if (value != -ESHUTDOWN)

				composite_setup_complete(gadget->ep0, req);

		}

	} else if (value == USB_GADGET_DELAYED_STATUS && w_length != 0) {