USB: u_ether: Fix race between gether_disconnect and rx_submit
Race is happening when both rx_submit() and gether_disconnect()
executes in parallel. When rndis is disabled, in gether_disconnect()
dev port_usb is set to NULL. On other side, rx_sumit() executes in
parallel and dev port_usb is accesed leading to NULL pointer
dereference.
Fix the issue by extending the spin_lock protection for the
dev port_usb in rx_submit().
CRs-Fixed: 658992
Change-Id: Ie788cde9dac56230046503be68ad3ab8a9839eec
Signed-off-by:
Saket Saurabh <ssaurabh@codeaurora.org>
Loading
Please register or sign in to comment