Commit ecd44cff authored Mar 04, 2016 by Vijayavardhan Vennapusa

USB: f_rndis: Fix NULL pointer dereference during composition switch



During fast RNDIS enable/disable, there is a chance that rndis driver
unbind race with rndis_cmd_complete and results in NULL pointer
dereference. Fix this by having check if before handling rndis command
received.

CRs-Fixed: 984950
Change-Id: Ie54c5083866db9f9d1b80bb5438b1d82db15580f
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>

parent b65b7cae

drivers/usb/gadget/function/f_rndis.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -522,6 +522,9 @@ static void rndis_command_complete(struct usb_ep ep, struct usb_request req)
		int status;
		rndis_init_msg_type *buf;

		if (!rndis \|\| !rndis->notify \|\| !rndis->notify->driver_data)
		return;

		if (!rndis->port.func.config \|\| !rndis->port.func.config->cdev)
		return;
		else