From 897fb2d0653b481b83d77685e4b20be702027afc Mon Sep 17 00:00:00 2001 From: kvaradarajan Date: Tue, 18 Jun 2019 11:29:49 +0000 Subject: [PATCH] USB: Fix race between gether_disconnect and rx_submit On spin lock release in rx_submit, gether_disconnect get a chance to run, it makes port_usb NULL, rx_submit access NULL port USB, hence null pointer crash. Fixed by releasing the lock in rx_submit after port_usb is used. Signed-off-by: KVaradarajan --- drivers/usb/gadget/function/u_ether.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c index 737bd77..76cf1e4 100644 --- a/drivers/usb/gadget/function/u_ether.c +++ b/drivers/usb/gadget/function/u_ether.c @@ -186,11 +186,11 @@ static void defer_kevent(struct eth_dev *dev, int flag) out = dev->port_usb->out_ep; else out = NULL; - spin_unlock_irqrestore(&dev->lock, flags); - if (!out) + if (!out) { + spin_unlock_irqrestore(&dev->lock, flags); return -ENOTCONN; - + } /* Padding up to RX_EXTRA handles minor disagreements with host. * Normally we use the USB "terminate on short read" convention; @@ -215,6 +215,7 @@ static void defer_kevent(struct eth_dev *dev, int flag) if (dev->port_usb->is_fixed) size = max_t(size_t, size, dev->port_usb->fixed_out_len); + spin_unlock_irqrestore(&dev->lock, flags); skb = __netdev_alloc_skb(dev->net, size + NET_IP_ALIGN, gfp_flags); if (skb == NULL) { DBG(dev, "no rx skb\n"); -- 1.9.1