Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b3b13a88 authored by Krzysztof Opasiak's avatar Krzysztof Opasiak Committed by Gerrit - the friendly Code Review server
Browse files

usb: gadget: f_hid: fix: Don't access hidg->req without spinlock held 



hidg->req should be accessed only with write_spinlock held as it is
set to NULL when we get disabled by host.

Change-Id: Ic933da63cc2e7087b8e68398499d367fae328499
Signed-off-by: default avatarKrzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
Git-commit: 25cd9721c2b16ee0d775e36ec3af31f392003f80
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git


Signed-off-by: default avatarAjay Agarwal <ajaya@codeaurora.org>
parent d160ea33

drivers/usb/gadget/function/f_hid.c

+4 −4
Original line number Diff line number Diff line
@@ -367,7 +367,7 @@ try_again: 
	count  = min_t(unsigned, count, hidg->report_length);



	spin_unlock_irqrestore(&hidg->write_spinlock, flags);

	status = copy_from_user(hidg->req->buf, buffer, count);

	status = copy_from_user(req->buf, buffer, count);



	if (status != 0) {

		ERROR(hidg->func.config->cdev,
@@ -378,9 +378,9 @@ try_again: 


	spin_lock_irqsave(&hidg->write_spinlock, flags);



	/* we our function has been disabled by host */

	/* when our function has been disabled by host */

	if (!hidg->req) {

		free_ep_req(hidg->in_ep, hidg->req);

		free_ep_req(hidg->in_ep, req);

		/*

		 * TODO

		 * Should we fail with error here?
@@ -394,7 +394,7 @@ try_again: 
	req->complete = f_hidg_req_complete;

	req->context  = hidg;



	status = usb_ep_queue(hidg->in_ep, hidg->req, GFP_ATOMIC);

	status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC);

	if (status < 0) {

		ERROR(hidg->func.config->cdev,

			"usb_ep_queue error on int endpoint %zd\n", status);