Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e4827cf0 authored by qctecmdr Service's avatar qctecmdr Service Committed by Gerrit - the friendly Code Review server
Browse files

Merge "usb: gadget: f_mtp: Fix issue of NULL pointer access in mtp_read"

parents bb84735e c24c3f1d

drivers/usb/gadget/function/f_mtp.c

+5 −4
Original line number Diff line number Diff line
@@ -582,10 +582,6 @@ static ssize_t mtp_read(struct file *fp, char __user *buf, 


	DBG(cdev, "mtp_read(%zu)\n", count);



	len = ALIGN(count, dev->ep_out->maxpacket);

	if (len > mtp_rx_req_len)

		return -EINVAL;



	/* we will block until we're online */

	DBG(cdev, "mtp_read: waiting for online state\n");

	ret = wait_event_interruptible(dev->read_wq,
@@ -594,6 +590,11 @@ static ssize_t mtp_read(struct file *fp, char __user *buf, 
		r = ret;

		goto done;

	}



	len = ALIGN(count, dev->ep_out->maxpacket);

	if (len > mtp_rx_req_len)

		return -EINVAL;



	spin_lock_irq(&dev->lock);

	if (dev->state == STATE_OFFLINE) {

		spin_unlock_irq(&dev->lock);