Commit d26b227b authored Apr 09, 2014 by Guang Jian Zeng

net: usb: rmnet: Fix the issue between disconnect and completion handler



There is a issue between device disconnect and completion handler.
If the rmnet_usb_ctrl_disconnect function is happened before completion
handler. Then the system will be crashed after calling usb_autopm_put
_interface function since disconnect function frees rmnet ctrl device
memory and completion handler uses already freed memory. Adding check
for usb device ready state when called usb_autopm_put_interface function
to avoid crash.

CRs-fixed: 646272
Change-Id: I89ba1b899a29ccd82794f14599723681b817d483
Signed-off-by: Guang Jian Zeng <gzeng@codeaurora.org>

parent c779b47e

drivers/net/usb/rmnet_usb_ctrl.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -479,6 +479,11 @@ static int rmnet_usb_ctrl_write_cmd(struct rmnet_ctrl_udev *dev, u8 req,
		if (ret < 0)
		dev->tx_ctrl_err_cnt++;

		/* if we are here after device disconnect
		* usb_unbind_interface() takes care of
		* residual pm_autopm_get_interface_* calls
		*/
		if (test_bit(RMNET_CTRL_DEV_READY, &dev->status))
		usb_autopm_put_interface(dev->intf);

		return ret;