From 305aaf9205a3cedd08a1f243dc4a338bd1524fb2 Mon Sep 17 00:00:00 2001 From: Mayank Rana Date: Fri, 15 Feb 2013 14:55:30 +0530 Subject: [PATCH] usb: gadget: u_ether: Fix NULL pointer derefernce crash port->port_usb can be NULL if USB cable is disconnected when net device is trying to transfer data which is causing device to crash. Hence add changes to eliminate need of accessing port->port_usb to see multi_xfer_pkt value. CRs-Fixed: 452642 Change-Id: I60bd2302371238707e951c77912b155d75dc8570 Signed-off-by: Mayank Rana --- drivers/usb/gadget/u_ether.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c index 0c9aa1a4d70f..ad99345cef24 100644 --- a/drivers/usb/gadget/u_ether.c +++ b/drivers/usb/gadget/u_ether.c @@ -604,11 +604,13 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, unsigned long flags; struct usb_ep *in; u16 cdc_filter; + bool multi_pkt_xfer = false; spin_lock_irqsave(&dev->lock, flags); if (dev->port_usb) { in = dev->port_usb->in_ep; cdc_filter = dev->port_usb->cdc_filter; + multi_pkt_xfer = dev->port_usb->multi_pkt_xfer; } else { in = NULL; cdc_filter = 0; @@ -621,7 +623,7 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, } /* Allocate memory for tx_reqs to support multi packet transfer */ - if (dev->port_usb->multi_pkt_xfer && !dev->tx_req_bufsize) + if (multi_pkt_xfer && !dev->tx_req_bufsize) alloc_tx_buffer(dev); /* apply outgoing CDC or RNDIS filters */ @@ -684,7 +686,7 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, dev->tx_skb_hold_count++; spin_unlock_irqrestore(&dev->req_lock, flags); - if (dev->port_usb->multi_pkt_xfer) { + if (multi_pkt_xfer) { memcpy(req->buf + req->length, skb->data, skb->len); req->length = req->length + skb->len; length = req->length; @@ -756,7 +758,7 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, } if (retval) { - if (!dev->port_usb->multi_pkt_xfer) + if (!multi_pkt_xfer) dev_kfree_skb_any(skb); drop: dev->net->stats.tx_dropped++;