Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

Merge "USB: gadget: u_bam: Fix null pointer access in BAM2BAM connect work"

This commit is contained in:
Linux Build Service Account 2015-06-25 02:25:25 -07:00 committed by Gerrit - the friendly Code Review server
parent 2565b04352 9e584a282a
commit 1156c2e7a4
1 changed files with 31 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
drivers/usb/gadget/u_bam.c
View File

@ -1304,34 +1304,6 @@ static void gbam2bam_connect_work(struct work_struct *w)
}
d = &port->data_ch;
d->rx_req = usb_ep_alloc_request(port->port_usb->out, GFP_ATOMIC);
if (!d->rx_req) {
pr_err("%s: out of memory\n", __func__);
spin_unlock(&port->port_lock_dl);
spin_unlock_irqrestore(&port->port_lock_ul, flags_ul);
spin_unlock_irqrestore(&port->port_lock, flags);
return;
}
d->rx_req->context = port;
d->rx_req->complete = gbam_endless_rx_complete;
d->rx_req->length = 0;
d->rx_req->no_interrupt = 1;
d->tx_req = usb_ep_alloc_request(port->port_usb->in, GFP_ATOMIC);
if (!d->tx_req) {
pr_err("%s: out of memory\n", __func__);
spin_unlock(&port->port_lock_dl);
spin_unlock_irqrestore(&port->port_lock_ul, flags_ul);
spin_unlock_irqrestore(&port->port_lock, flags);
return;
}
d->tx_req->context = port;
d->tx_req->complete = gbam_endless_tx_complete;
d->tx_req->length = 0;
d->tx_req->no_interrupt = 1;
/*
* Unlock the port here and not at the end of this work,
* because we do not want to activate usb_bam, ipa and
@ -2174,6 +2146,37 @@ int gbam_connect(struct grmnet *gr, u8 port_num,
port->port_usb = gr;
port->gadget = port->port_usb->gadget;
d->rx_req = usb_ep_alloc_request(port->port_usb->out, GFP_ATOMIC);
if (!d->rx_req) {
pr_err("%s: out of memory\n", __func__);
d->rx_req = NULL;
spin_unlock(&port->port_lock_dl);
spin_unlock_irqrestore(&port->port_lock_ul, flags_ul);
spin_unlock_irqrestore(&port->port_lock, flags);
return -ENOMEM;
}
d->rx_req->context = port;
d->rx_req->complete = gbam_endless_rx_complete;
d->rx_req->length = 0;
d->rx_req->no_interrupt = 1;
d->tx_req = usb_ep_alloc_request(port->port_usb->in, GFP_ATOMIC);
if (!d->tx_req) {
pr_err("%s: out of memory\n", __func__);
usb_ep_free_request(port->port_usb->out, d->rx_req);
d->tx_req = NULL;
spin_unlock(&port->port_lock_dl);
spin_unlock_irqrestore(&port->port_lock_ul, flags_ul);
spin_unlock_irqrestore(&port->port_lock, flags);
return -ENOMEM;
}
d->tx_req->context = port;
d->tx_req->complete = gbam_endless_tx_complete;
d->tx_req->length = 0;
d->tx_req->no_interrupt = 1;
if (d->trans == USB_GADGET_XPORT_BAM) {
d->to_host = 0;
d->to_modem = 0;