Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a4d3d58c authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "USB: f_fs: Fix use-after-free when unbind races with epfile_io()"

parents c16f4251 faf47215

drivers/usb/gadget/function/f_fs.c

+3 −3
Original line number Diff line number Diff line
@@ -1101,8 +1101,6 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) 
			}

		}



		ffs_log("ep status %d for req %pK", ep->status, req);



		if (interrupted) {

			ret = -EINTR;

			goto error_mutex;
@@ -1115,8 +1113,10 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) 
		 * disabled (disconnect) or changed

		 * (composition switch) ?

		 */

		if (epfile->ep == ep)

		if (epfile->ep == ep) {

			ret = ep->status;

			ffs_log("ep status %d for req %pK", ep->status, req);

		}

		spin_unlock_irq(&epfile->ffs->eps_lock);

		if (io_data->read && ret > 0)

			ret = __ffs_epfile_read_data(epfile, data, ep->status,