Commit f1052d05 authored Jun 18, 2019 by Kiruthika Varadarajan Committed by Greg Kroah-Hartman Jul 21, 2019

usb: gadget: ether: Fix race between gether_disconnect and rx_submit



commit d29fcf7078bc8be2b6366cbd4418265b53c94fac upstream.

On spin lock release in rx_submit, gether_disconnect get a chance to
run, it makes port_usb NULL, rx_submit access NULL port USB, hence null
pointer crash.

Fixed by releasing the lock in rx_submit after port_usb is used.

Fixes: 2b3d942c ("usb ethernet gadget: split out network core")
Cc: <stable@vger.kernel.org>
Signed-off-by: Kiruthika Varadarajan <Kiruthika.Varadarajan@harman.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent feca0ce3

drivers/usb/gadget/function/u_ether.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -198,11 +198,12 @@ rx_submit(struct eth_dev dev, struct usb_request req, gfp_t gfp_flags)
		out = dev->port_usb->out_ep;
		else
		out = NULL;
		spin_unlock_irqrestore(&dev->lock, flags);

		if (!out)
		{
		spin_unlock_irqrestore(&dev->lock, flags);
		return -ENOTCONN;

		}

		/* Padding up to RX_EXTRA handles minor disagreements with host.
		* Normally we use the USB "terminate on short read" convention;
		@@ -223,6 +224,7 @@ rx_submit(struct eth_dev dev, struct usb_request req, gfp_t gfp_flags)

		if (dev->port_usb->is_fixed)
		size = max_t(size_t, size, dev->port_usb->fixed_out_len);
		spin_unlock_irqrestore(&dev->lock, flags);

		skb = alloc_skb(size + NET_IP_ALIGN, gfp_flags);
		if (skb == NULL) {