Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 813be11c authored by Ido Shayevitz's avatar Ido Shayevitz
Browse files

usb: gadget: f_mbim: Fix crash on cable disconnect when no set alt 



f_mbim driver set the port, enable endpoints and open bam pipes
only when the host sent set_alt=1. In other cases (for example
using non Win8 host), set_alt=1 will not occur.

Bail out from mbim_disable() in case set_alt=1 did not happen, to avoid
the case that the port was not initialized. Specifically this fix avoid
a crash of trying to lock uninitialized spinlock port->lock.

CRs-Fixed: 690719
Change-Id: I48667c94e07b92da3a814b9501428b84bb2a2bd1
Signed-off-by: default avatarIdo Shayevitz <idos@codeaurora.org>
parent cc39ddf5

drivers/usb/gadget/f_mbim.c

+13 −8
Original line number Diff line number Diff line
@@ -1496,13 +1496,24 @@ static void mbim_disable(struct usb_function *f) 


	pr_info("SET DEVICE OFFLINE\n");

	atomic_set(&mbim->online, 0);

	mbim->data_alt_int = 0;



	 /* Disable Control Path */

	if (mbim->not_port.notify->driver_data) {

		usb_ep_disable(mbim->not_port.notify);

		mbim->not_port.notify->driver_data = NULL;

	}

	atomic_set(&mbim->not_port.notify_count, 0);

	mbim->not_port.notify_state = MBIM_NOTIFY_NONE;



	mbim_clear_queues(mbim);

	mbim_reset_function_queue(mbim);



	/* Disable Data Path  - only if it was initialized already (alt=1) */

	if (mbim->data_alt_int == 0) {

		pr_debug("MBIM data interface is not opened. Returning\n");

		return;

	}



	if (mbim->xport == USB_GADGET_XPORT_BAM2BAM_IPA &&

			gadget_is_dwc3(cdev->gadget)) {

		msm_ep_unconfig(mbim->bam_port.out);
@@ -1511,13 +1522,7 @@ static void mbim_disable(struct usb_function *f) 


	mbim_bam_disconnect(mbim);



	if (mbim->not_port.notify->driver_data) {

		usb_ep_disable(mbim->not_port.notify);

		mbim->not_port.notify->driver_data = NULL;

	}



	atomic_set(&mbim->not_port.notify_count, 0);



	mbim->data_alt_int = 0;

	pr_info("mbim deactivated\n");

}