usb: gadget: ether: Fix race between gether_disconnect and rx_submit (d29fcf70) · Commits · 戴 / test

On spin lock release in rx_submit, gether_disconnect get a chance to run, it makes port_usb NULL, rx_submit access NULL port USB, hence null pointer crash. Fixed by releasing the lock in rx_submit after port_usb is used. Fixes: ("usb ethernet gadget: split out network core") Cc: <stable@vger.kernel.org> Signed-off-by:

Kiruthika Varadarajan <Kiruthika.Varadarajan@harman.com> Signed-off-by:

Felipe Balbi <felipe.balbi@linux.intel.com>

drivers/usb/gadget/function/u_ether.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -186,11 +186,12 @@ rx_submit(struct eth_dev dev, struct usb_request req, gfp_t gfp_flags)
		out = dev->port_usb->out_ep;
		else
		out = NULL;
		spin_unlock_irqrestore(&dev->lock, flags);

		if (!out)
		{
		spin_unlock_irqrestore(&dev->lock, flags);
		return -ENOTCONN;

		}

		/* Padding up to RX_EXTRA handles minor disagreements with host.
		* Normally we use the USB "terminate on short read" convention;
		@@ -214,6 +215,7 @@ rx_submit(struct eth_dev dev, struct usb_request req, gfp_t gfp_flags)

		if (dev->port_usb->is_fixed)
		size = max_t(size_t, size, dev->port_usb->fixed_out_len);
		spin_unlock_irqrestore(&dev->lock, flags);

		skb = __netdev_alloc_skb(dev->net, size + NET_IP_ALIGN, gfp_flags);
		if (skb == NULL) {

Admin message