shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-08 11:50:43 +09:00
Code Issues Packages Projects Releases Wiki Activity

ANDROID: usb: gadget: fix NULL pointer issue in mtp_read()

Browse Source 
pointer dev->ep_out->desc is set to NULL if MTP function
is disabled during read operation. So we need to do pointer check
before access it and add spin lock protection in case it's modified
at another place in future.

Patchset: mtp

Change-Id: I96d3d685e93276c9065a1aa7b0cbbdc2e159aa6f
Signed-off-by: Jiebing Li <jiebing.li@intel.com>
Signed-off-by: Wang, Yu <yu.y.wang@intel.com>
Signed-off-by: Russ Weight <russell.h.weight@intel.com>
This commit is contained in:
Jiebing Li
2015-03-10 11:25:50 +08:00
committed by Dmitry Shmidt
parent df5d32089a
commit 3bbd898081
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/usb/gadget/function/f_mtp.c
View File

@@ -541,14 +541,10 @@ static ssize_t mtp_read(struct file *fp, char __user *buf,
ssize_t r = count;
unsigned xfer;
int ret = 0;
size_t len;
size_t len = 0;
DBG(cdev, "mtp_read(%zu)\n", count);
len = usb_ep_align_maybe(cdev->gadget, dev->ep_out, count);
if (len > MTP_BULK_BUFFER_SIZE)
return -EINVAL;
/* we will block until we're online */
DBG(cdev, "mtp_read: waiting for online state\n");
ret = wait_event_interruptible(dev->read_wq,
@@ -558,6 +554,14 @@ static ssize_t mtp_read(struct file *fp, char __user *buf,
goto done;
}
spin_lock_irq(&dev->lock);
if (dev->ep_out->desc) {
len = usb_ep_align_maybe(cdev->gadget, dev->ep_out, count);
if (len > MTP_BULK_BUFFER_SIZE) {
spin_unlock_irq(&dev->lock);
return -EINVAL;
}
}
if (dev->state == STATE_CANCELED) {
/* report cancelation to userspace */
dev->state = STATE_READY;