Commit 9bb97b02 authored Dec 07, 2017 by Ajay Agarwal

usb: gadget: Mark notify_modem as NULL on gbridge_disconnect



On some targets, f_serial switches transport path from
char_bridge to TTY in DUN+SoftAP scenario. As a part of that,
we call gbridge_disconnect but notify_modem callback is still
marked as gbridge_notify_modem. Then on getting a SETUP req
from host PC, gbridge_notify_modem is called which can lead
to NULL pointer dereference because port_usb is NULL.

Fix this by marking notify_modem callback as NULL on
gbridge_disconnect.

Change-Id: I4470030cde6f38b905f7a88e16ed9f261a8954d6
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>

parent 6f6c6e07

drivers/usb/gadget/function/u_data_bridge.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -993,6 +993,7 @@ void gbridge_disconnect(void *gptr, u8 portno)

		spin_lock_irqsave(&port->port_lock, flags);
		port->is_connected = false;
		gser->notify_modem = NULL;
		port->port_usb = NULL;
		port->nbytes_from_host = port->nbytes_to_host = 0;
		port->nbytes_to_port_bridge = 0;