A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 00:24:41 -04:00
Code Issues Projects Releases Packages Wiki Activity

usb: dwc3: Avoid NULL pointer access

Browse source 
During Halt Endpoint CH9 test with RNDIS composition
NULL pointer dereference is occurring in
__dwc3_gadget_ep_set_halt function which is trying to
access trb_pool which is already freed. In this case
set_alt 0 is getting called before__dwc3_gadget_ep_set_halt.
As a part of set_alt, ipa_disconnect_handler is getting
called which is freeing the trbs. __dwc3_gadget_ep_set_halt
function is called as a part of std_request from Host side
to halt endpoint. This change adds a NULL check before accessing
trb_pool.

Change-Id: Id51494310f713b9c593e29449442661a1170ee6f
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
This commit is contained in:
Pratham Pratap 2017-12-05 14:38:29 +05:30 • committed by Jack Pham
commit 1e3f5743e6
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
drivers/usb/dwc3/gadget.c
View file

@ -982,6 +982,9 @@ static struct dwc3_trb *dwc3_ep_prev_trb(struct dwc3_ep *dep, u8 index)
{
u8 tmp = index;
if (!dep->trb_pool)
return NULL;
if (!tmp)
tmp = DWC3_TRB_NUM - 1;
@ -1730,7 +1733,11 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
else
trb = &dwc->ep0_trb[dep->trb_enqueue];
transfer_in_flight = trb->ctrl & DWC3_TRB_CTRL_HWO;
if (trb)
transfer_in_flight = trb->ctrl & DWC3_TRB_CTRL_HWO;
else
transfer_in_flight = false;
started = !list_empty(&dep->started_list);
if (!protocol && ((dep->direction && transfer_in_flight) ||