Piteball/android_kernel_google_msm
1
0
Fork 0
mirror of https://github.com/followmsi/android_kernel_google_msm.git synced 2024-11-06 23:17:41 +00:00
Code Issues Projects Releases Wiki Activity

usb: gadget: u_ether: Fix NULL pointer derefernce crash

Browse source 
port->port_usb can be NULL if USB cable is disconnected when
net device is trying to transfer data which is causing device
to crash. Hence add changes to eliminate need of accessing
port->port_usb to see multi_xfer_pkt value.

CRs-Fixed: 452642
Change-Id: I60bd2302371238707e951c77912b155d75dc8570
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
This commit is contained in:
Mayank Rana 2013-02-15 14:55:30 +05:30 committed by Iliyan Malchev
parent 30c3f2ef61
commit 305aaf9205
1 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
drivers/usb/gadget/u_ether.c
View file

@ -604,11 +604,13 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
unsigned long flags; unsigned long flags;
struct usb_ep *in; struct usb_ep *in;
u16 cdc_filter; u16 cdc_filter;
bool multi_pkt_xfer = false;
spin_lock_irqsave(&dev->lock, flags); spin_lock_irqsave(&dev->lock, flags);
if (dev->port_usb) { if (dev->port_usb) {
in = dev->port_usb->in_ep; in = dev->port_usb->in_ep;
cdc_filter = dev->port_usb->cdc_filter; cdc_filter = dev->port_usb->cdc_filter;
multi_pkt_xfer = dev->port_usb->multi_pkt_xfer;
} else { } else {
in = NULL; in = NULL;
cdc_filter = 0; cdc_filter = 0;
@ -621,7 +623,7 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
} }
/* Allocate memory for tx_reqs to support multi packet transfer */ /* Allocate memory for tx_reqs to support multi packet transfer */
if (dev->port_usb->multi_pkt_xfer && !dev->tx_req_bufsize) if (multi_pkt_xfer && !dev->tx_req_bufsize)
alloc_tx_buffer(dev); alloc_tx_buffer(dev);
/* apply outgoing CDC or RNDIS filters */ /* apply outgoing CDC or RNDIS filters */
@ -684,7 +686,7 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
dev->tx_skb_hold_count++; dev->tx_skb_hold_count++;
spin_unlock_irqrestore(&dev->req_lock, flags); spin_unlock_irqrestore(&dev->req_lock, flags);
if (dev->port_usb->multi_pkt_xfer) { if (multi_pkt_xfer) {
memcpy(req->buf + req->length, skb->data, skb->len); memcpy(req->buf + req->length, skb->data, skb->len);
req->length = req->length + skb->len; req->length = req->length + skb->len;
length = req->length; length = req->length;
@ -756,7 +758,7 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
} }
if (retval) { if (retval) {
if (!dev->port_usb->multi_pkt_xfer) if (!multi_pkt_xfer)
dev_kfree_skb_any(skb); dev_kfree_skb_any(skb);
drop: drop:
dev->net->stats.tx_dropped++; dev->net->stats.tx_dropped++;