USB: u_ether: Check if port_usb is NULL before accessing
Rndis tx requests are queued to the controller, while disconnect
is in progress. There is a chance of getting the completion of
those requests after dev->port_usb is set to NULL. This leads to
NULL pointer dereference in tx_complete().
Hence, check if dev->port_usb is NULL before accessing it
in tx_complete() and free the current request accordingly.
Change-Id: I42a427f7e51ffe4f81768756d835d123778df260
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index d50510f..76dea29 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -511,6 +511,11 @@
int length;
int retval;
+ if (!dev->port_usb) {
+ usb_ep_free_request(ep, req);
+ return;
+ }
+
switch (req->status) {
default:
dev->net->stats.tx_errors++;