Commit cef1d4fb authored Jun 01, 2016 by Chandana Kishori Chiluveru Committed by Gerrit - the friendly Code Review server Jun 01, 2016

USB: gadget: u_smd: Fix NULL pointer crash issue

When cable is disconnected during smd data transfers, there
is a chance that gsmd_disconnect() and smd notify callback for close
event can race each other and results in NULL pointer deference crash.
Hence fix it by checking port_usb pointer in gsmd_stop_io
and access the values only if port_usb pointer is not NULL.

Change-Id: I4414ebdc4862a82f9e3e7480fae04e503c4bc27c
Signed-off-by: Chandana Kishori Chiluveru <cchiluve@codeaurora.org>

parent c6931ad2

drivers/usb/gadget/function/u_smd.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -548,6 +548,9 @@ static void gsmd_stop_io(struct gsmd_port *port)
		gsmd_free_requests(in, &port->write_pool);
		port->n_read = 0;
		port->cbits_to_laptop = 0;
		} else {
		spin_unlock(&port->port_lock);
		return;
		}

		if (port->port_usb->send_modem_ctrl_bits)