Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fff8ad6a authored by Sriharsha Allenki's avatar Sriharsha Allenki
Browse files

usb: gadget: mtp: Fix possible NULL pointer dereference 



If the vfs_write fails for the possible last request,
then there is no request queued to the controller and
read_req is NULL. And usb_ep_dequeue will result in a
NULL pointer dereference. Fix this by validating the
read_req before usb_ep_dequeue.

Change-Id: I9ddb3783ec1a56a59da72ff73283b8c3cafac056
Signed-off-by: default avatarSriharsha Allenki <sallenki@codeaurora.org>
parent 4e009b46

drivers/usb/gadget/function/f_mtp.c

+2 −1
Original line number Diff line number Diff line
@@ -955,6 +955,7 @@ static void receive_file_work(struct work_struct *data) 
				r = -EIO;

				if (dev->state != STATE_OFFLINE)

					dev->state = STATE_ERROR;

				if (read_req && !dev->rx_done)

					usb_ep_dequeue(dev->ep_out, read_req);

				break;

			}