Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 955194a7 authored by Pavankumar Kondeti's avatar Pavankumar Kondeti
Browse files

net: rmnet_usb: don't access unet after freeing 



When mux is enabled, unet is accessed after freeing it in
rmnet_usb_disconnect(). Fix it by caching the variables that
are required to retrieve unet from unet_list array before
freeing the unet.

CRs-Fixed: 562671
Change-Id: Id21a99db6b3f5da05e89e17f04c01202ea996d06
Signed-off-by: default avatarPavankumar Kondeti <pkondeti@codeaurora.org>
parent 329a6b3b

drivers/net/usb/rmnet_usb_data.c

+5 −4
Original line number Diff line number Diff line
@@ -827,15 +827,16 @@ static void rmnet_usb_disconnect(struct usb_interface *intf) 
	struct usbnet		*unet = usb_get_intfdata(intf);

	struct rmnet_ctrl_dev	*dev;

	unsigned int		n, rdev_cnt, unet_id;

	struct driver_info	*info = unet->driver_info;

	bool			mux = unet->data[4];



	rdev_cnt = unet->data[4] ? no_rmnet_insts_per_dev : 1;

	rdev_cnt = mux ? no_rmnet_insts_per_dev : 1;



	device_set_wakeup_enable(&unet->udev->dev, 0);



	for (n = 0; n < rdev_cnt; n++) {

		unet_id = n + unet->driver_info->data * no_rmnet_insts_per_dev;

		unet =

		unet->data[4] ? unet_list[unet_id] : usb_get_intfdata(intf);

		unet_id = n + info->data * no_rmnet_insts_per_dev;

		unet = mux ? unet_list[unet_id] : usb_get_intfdata(intf);

		device_remove_file(&unet->net->dev, &dev_attr_dbg_mask);



		dev = (struct rmnet_ctrl_dev *)unet->data[1];