Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3303e636 authored by Hemant Kumar's avatar Hemant Kumar Committed by Gerrit - the friendly Code Review server
Browse files

usb: gadget: Dereference i_bdev of inode only for block device 



If a storage device is not a block device fsg_lun_open() and
fsg_lun_close() still dereference i_bdev pointer from inode.
This results into NULL pointer dereference. Hence fix this by
moving i_bdev dereference under NULL check in fsg_lun_open()
and add NULL check for i_bdev in fsg_lun_close().

CRs-Fixed: 782787
Change-Id: Ia045d80464fce9e16effacbff5f35d5d8627b06f
Signed-off-by: default avatarHemant Kumar <hemantk@codeaurora.org>
parent cd2c69a8

drivers/usb/gadget/storage_common.c

+16 −14
Original line number Diff line number Diff line
@@ -437,12 +437,14 @@ static void fsg_lun_close(struct fsg_lun *curlun) 


	if (curlun->filp) {

		inode = file_inode(curlun->filp);

		if (inode->i_bdev) {

			bdi = &inode->i_bdev->bd_queue->backing_dev_info;



			if ((bdi->capabilities & BDI_CAP_STRICTLIMIT) &&

				bdi_set_max_ratio(bdi, curlun->max_ratio))

			pr_debug("%s, error in setting max_ratio\n", __func__);



				pr_debug("%s, error in setting max_ratio\n",

						__func__);

		}

		LDBG(curlun, "close backing file\n");

		fput(curlun->filp);

		curlun->filp = NULL;
@@ -510,6 +512,16 @@ static int fsg_lun_open(struct fsg_lun *curlun, const char *filename) 
	} else if (inode->i_bdev) {

		blksize = bdev_logical_block_size(inode->i_bdev);

		blkbits = blksize_bits(blksize);



		bdi = &inode->i_bdev->bd_queue->backing_dev_info;

		if (bdi->capabilities & BDI_CAP_STRICTLIMIT) {

			curlun->max_ratio = bdi->max_ratio;

			curlun->nofua = 1;



			if (bdi_set_max_ratio(bdi, uicc_ums_max_ratio))

				pr_debug("%s, error in setting max_ratio\n",

						__func__);

		}

	} else {

		blksize = 512;

		blkbits = 9;
@@ -542,16 +554,6 @@ static int fsg_lun_open(struct fsg_lun *curlun, const char *filename) 
	curlun->file_length = size;

	curlun->num_sectors = num_sectors;



	bdi = &inode->i_bdev->bd_queue->backing_dev_info;



	if (bdi->capabilities & BDI_CAP_STRICTLIMIT) {

		curlun->max_ratio = bdi->max_ratio;

		curlun->nofua = 1;



		if (bdi_set_max_ratio(bdi, uicc_ums_max_ratio))

			pr_debug("%s, error in setting max_ratio\n", __func__);

	}



	LDBG(curlun, "open backing file: %s\n", filename);

	return 0;