Commit c45c996d authored by Kiruthika Varadarajan's avatar Kiruthika Varadarajan Committed by Kleber Sacilotto de Souza

usb: gadget: ether: Fix race between gether_disconnect and rx_submit

BugLink: https://bugs.launchpad.net/bugs/1838467

commit d29fcf70 upstream.

On spin lock release in rx_submit, gether_disconnect get a chance to
run, it makes port_usb NULL, rx_submit access NULL port USB, hence null
pointer crash.

Fixed by releasing the lock in rx_submit after port_usb is used.

Fixes: 2b3d942c ("usb ethernet gadget: split out network core")
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarKiruthika Varadarajan <Kiruthika.Varadarajan@harman.com>
Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarConnor Kuehl <connor.kuehl@canonical.com>
Signed-off-by: default avatarKhalid Elmously <khalid.elmously@canonical.com>
parent 5ddf4257
...@@ -207,11 +207,12 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags) ...@@ -207,11 +207,12 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
out = dev->port_usb->out_ep; out = dev->port_usb->out_ep;
else else
out = NULL; out = NULL;
spin_unlock_irqrestore(&dev->lock, flags);
if (!out) if (!out)
{
spin_unlock_irqrestore(&dev->lock, flags);
return -ENOTCONN; return -ENOTCONN;
}
/* Padding up to RX_EXTRA handles minor disagreements with host. /* Padding up to RX_EXTRA handles minor disagreements with host.
* Normally we use the USB "terminate on short read" convention; * Normally we use the USB "terminate on short read" convention;
...@@ -232,6 +233,7 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags) ...@@ -232,6 +233,7 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
if (dev->port_usb->is_fixed) if (dev->port_usb->is_fixed)
size = max_t(size_t, size, dev->port_usb->fixed_out_len); size = max_t(size_t, size, dev->port_usb->fixed_out_len);
spin_unlock_irqrestore(&dev->lock, flags);
skb = alloc_skb(size + NET_IP_ALIGN, gfp_flags); skb = alloc_skb(size + NET_IP_ALIGN, gfp_flags);
if (skb == NULL) { if (skb == NULL) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment