Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 015accbf authored by Arumuga Durai A's avatar Arumuga Durai A
Browse files

Usb: Gadget: u_bam_data: Fix NULL ptr dereference in b2b_data_connect_work 



During device suspend, bam_data_disconnect disables the usb endpoints
and free the usb request lead to racing. As a part of device resume
bam_data_connect_work dereferences usb request causing NULL pointer
dereference.Fix these by add spinlock.

CRs-Fixed: 1068378
Change-Id: I89aeebecb9c7a277a9e8cc63de963dd67851aeae
Signed-off-by: default avatarArumuga Durai A <cadurai@codeaurora.org>
parent f75272fe

drivers/usb/gadget/function/u_bam_data.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -1424,20 +1424,22 @@ void bam_data_disconnect(struct data_port *gr, enum function_type func, 
			 */

			 */

			spin_unlock_irqrestore(&port->port_lock, flags);

			spin_unlock_irqrestore(&port->port_lock, flags);

			usb_ep_disable(port->port_usb->in);

			usb_ep_disable(port->port_usb->in);

			spin_lock_irqsave(&port->port_lock, flags);

			if (d->tx_req) {

			if (d->tx_req) {

				usb_ep_free_request(port->port_usb->in,

				usb_ep_free_request(port->port_usb->in,

								d->tx_req);

								d->tx_req);

				d->tx_req = NULL;

				d->tx_req = NULL;

			}

			}

			spin_unlock_irqrestore(&port->port_lock, flags);





			usb_ep_disable(port->port_usb->out);

			usb_ep_disable(port->port_usb->out);

			spin_lock_irqsave(&port->port_lock, flags);

			if (d->rx_req) {

			if (d->rx_req) {

				usb_ep_free_request(port->port_usb->out,

				usb_ep_free_request(port->port_usb->out,

								d->rx_req);

								d->rx_req);

				d->rx_req = NULL;

				d->rx_req = NULL;

			}

			}





			spin_lock_irqsave(&port->port_lock, flags);





			/* Only for SYS2BAM mode related UL workaround */

			/* Only for SYS2BAM mode related UL workaround */

			if (d->src_pipe_type == USB_BAM_PIPE_SYS2BAM) {

			if (d->src_pipe_type == USB_BAM_PIPE_SYS2BAM) {