usb: gadget: u_ether: Fix NULL pointer derefernce crash
port->port_usb can be NULL if USB cable is disconnected when
net device is trying to transfer data which is causing device
to crash. Hence add changes to eliminate need of accessing
port->port_usb to see multi_xfer_pkt value.
CRs-Fixed: 452642
Change-Id: I60bd2302371238707e951c77912b155d75dc8570
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
index 0c9aa1a..ad99345 100644
--- a/drivers/usb/gadget/u_ether.c
+++ b/drivers/usb/gadget/u_ether.c
@@ -604,11 +604,13 @@
unsigned long flags;
struct usb_ep *in;
u16 cdc_filter;
+ bool multi_pkt_xfer = false;
spin_lock_irqsave(&dev->lock, flags);
if (dev->port_usb) {
in = dev->port_usb->in_ep;
cdc_filter = dev->port_usb->cdc_filter;
+ multi_pkt_xfer = dev->port_usb->multi_pkt_xfer;
} else {
in = NULL;
cdc_filter = 0;
@@ -621,7 +623,7 @@
}
/* Allocate memory for tx_reqs to support multi packet transfer */
- if (dev->port_usb->multi_pkt_xfer && !dev->tx_req_bufsize)
+ if (multi_pkt_xfer && !dev->tx_req_bufsize)
alloc_tx_buffer(dev);
/* apply outgoing CDC or RNDIS filters */
@@ -684,7 +686,7 @@
dev->tx_skb_hold_count++;
spin_unlock_irqrestore(&dev->req_lock, flags);
- if (dev->port_usb->multi_pkt_xfer) {
+ if (multi_pkt_xfer) {
memcpy(req->buf + req->length, skb->data, skb->len);
req->length = req->length + skb->len;
length = req->length;
@@ -756,7 +758,7 @@
}
if (retval) {
- if (!dev->port_usb->multi_pkt_xfer)
+ if (!multi_pkt_xfer)
dev_kfree_skb_any(skb);
drop:
dev->net->stats.tx_dropped++;