Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 92a3d6bf authored by Arumuga Durai A's avatar Arumuga Durai A
Browse files

USB: gadget: qdss: Fix null pointer dereference 



Unless bam_to_bam_ipa transport is used ipa_data_wq
won't allocate. During unbind of qdss function checks
the completion of ipa_data_wq leads to NULL pointer
dereference. Fix this by add proper check.

CRs-Fixed: 1110001
Change-Id: Iaf11a2b7575fa31f984b572d6bfffa44a38d9f8d
Signed-off-by: default avatarArumuga Durai A <cadurai@codeaurora.org>
parent bf10764e

drivers/usb/gadget/function/f_qdss.c

+7 −4
Original line number Diff line number Diff line 
/*

 * f_qdss.c -- QDSS function Driver

 *

 * Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.

 * Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.



 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -482,14 +482,15 @@ static void qdss_unbind(struct usb_configuration *c, struct usb_function *f) 
{

	struct f_qdss  *qdss = func_to_qdss(f);

	struct usb_gadget *gadget = c->cdev->gadget;

	enum transport_type dxport = qdss_ports[qdss->port_num].data_xport;

	int i;



	pr_debug("qdss_unbind\n");



	flush_workqueue(qdss->wq);

	if (dxport ==  USB_GADGET_XPORT_BAM2BAM_IPA)

		ipa_data_flush_workqueue();





	c->cdev->gadget->bam2bam_func_enabled = false;

	clear_eps(f);

	clear_desc(gadget, f);
@@ -1043,6 +1044,8 @@ static int qdss_bind_config(struct usb_configuration *c, unsigned char portno) 
		kfree(name);

		kfree(qdss);

	}

	if (dxport == USB_GADGET_XPORT_BAM2BAM_IPA ||

			dxport == USB_GADGET_XPORT_BAM2BAM)

		c->cdev->gadget->bam2bam_func_enabled = true;



	return status;