Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3f574e52 authored by qctecmdr Service's avatar qctecmdr Service Committed by Gerrit - the friendly Code Review server
Browse files

Merge "USB: f_accessory: Fix NULL pointer dereference in acc_read()"

parents efa1cb89 ab39b53f

drivers/usb/gadget/function/f_accessory.c

+9 −6
Original line number Diff line number Diff line
@@ -567,8 +567,7 @@ static ssize_t acc_read(struct file *fp, char __user *buf, 
{

	struct acc_dev *dev = fp->private_data;

	struct usb_request *req;

	ssize_t r = count;

	unsigned xfer;

	ssize_t r = count, xfer, len;

	int ret = 0;



	pr_debug("acc_read(%zu)\n", count);
@@ -589,6 +588,8 @@ static ssize_t acc_read(struct file *fp, char __user *buf, 
		goto done;

	}



	len = ALIGN(count, dev->ep_out->maxpacket);



	if (dev->rx_done) {

		// last req cancelled. try to get it.

		req = dev->rx_req[0];
@@ -598,7 +599,7 @@ static ssize_t acc_read(struct file *fp, char __user *buf, 
requeue_req:

	/* queue a request */

	req = dev->rx_req[0];

	req->length = count;

	req->length = len;

	dev->rx_done = 0;

	ret = usb_ep_queue(dev->ep_out, req, GFP_KERNEL);

	if (ret < 0) {
@@ -906,6 +907,8 @@ int acc_ctrlrequest(struct usb_composite_dev *cdev, 
			memset(dev->serial, 0, sizeof(dev->serial));

			dev->start_requested = 0;

			dev->audio_mode = 0;

			strlcpy(dev->manufacturer, "Android", ACC_STRING_SIZE);

			strlcpy(dev->model, "Android", ACC_STRING_SIZE);

		}

	}
@@ -1208,13 +1211,13 @@ static int acc_setup(void) 
	INIT_DELAYED_WORK(&dev->start_work, acc_start_work);

	INIT_WORK(&dev->hid_work, acc_hid_work);



	/* _acc_dev must be set before calling usb_gadget_register_driver */

	_acc_dev = dev;



	ret = misc_register(&acc_device);

	if (ret)

		goto err;



	/* _acc_dev must be set before calling usb_gadget_register_driver */

	_acc_dev = dev;



	return 0;



err: