usb: gadget: u_ether: Fix NULL pointer dereference issue
dev->port_usb can be NULL if USB cable is disconnected when
net device is trying to transfer data which is causing NULL
pointer dereference. Hence add changes to eliminate need of
accessing port->port_usb to see multi_xfer_pkt value.
Change-Id: Ia28399b896ec1e069abeee8fe477826de6bb5942
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index 76dea29..56bdb1a 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -632,11 +632,13 @@
unsigned long flags;
struct usb_ep *in;
u16 cdc_filter;
+ bool multi_pkt_xfer = false;
spin_lock_irqsave(&dev->lock, flags);
if (dev->port_usb) {
in = dev->port_usb->in_ep;
cdc_filter = dev->port_usb->cdc_filter;
+ multi_pkt_xfer = dev->port_usb->multi_pkt_xfer;
} else {
in = NULL;
cdc_filter = 0;
@@ -649,7 +651,7 @@
}
/* Allocate memory for tx_reqs to support multi packet transfer */
- if (dev->port_usb->multi_pkt_xfer && !dev->tx_req_bufsize)
+ if (multi_pkt_xfer && !dev->tx_req_bufsize)
alloc_tx_buffer(dev);
/* apply outgoing CDC or RNDIS filters */
@@ -719,7 +721,7 @@
dev->tx_skb_hold_count++;
spin_unlock_irqrestore(&dev->req_lock, flags);
- if (dev->port_usb->multi_pkt_xfer) {
+ if (multi_pkt_xfer) {
memcpy(req->buf + req->length, skb->data, skb->len);
req->length = req->length + skb->len;
length = req->length;
@@ -792,7 +794,7 @@
}
if (retval) {
- if (!dev->port_usb->multi_pkt_xfer)
+ if (!multi_pkt_xfer)
dev_kfree_skb_any(skb);
drop:
dev->net->stats.tx_dropped++;