A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 21:59:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

usb: gadget: Mark notify_modem as NULL on usb_cser_disconnect

Browse source 
On some targets, f_serial switches transport path from
char_bridge to TTY in DUN+SoftAP scenario. As a part of that,
we call usb_cser_disconnect but notify_modem callback is still
marked as usb_cser_notify_modem. Then on getting a SETUP req
from host PC, usb_cser_notify_modem is called which can lead
to NULL pointer dereference because port_usb is NULL.

Fix this by marking notify_modem callback as NULL on
usb_cser_disconnect.

Change-Id: I4470030cde6f38b905f7a88e16ed9f261a8954d6
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Signed-off-by: Chandana Kishori Chiluveru <cchiluve@codeaurora.org>
This commit is contained in:
Chandana Kishori Chiluveru 2018-06-26 16:17:46 +05:30 • committed by Gerrit - the friendly Code Review server
commit 4d8eb15487
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
drivers/usb/gadget/function/f_cdev.c
View file

@ -1556,8 +1556,10 @@ int usb_cser_connect(struct f_cdev *port)
void usb_cser_disconnect(struct f_cdev *port)
{
struct cserial *cser;
unsigned long flags;
cser = &port->port_usb;
usb_cser_stop_io(port);
/* lower DTR to modem */
@ -1565,6 +1567,7 @@ void usb_cser_disconnect(struct f_cdev *port)
spin_lock_irqsave(&port->port_lock, flags);
port->is_connected = false;
cser->notify_modem = NULL;
port->nbytes_from_host = port->nbytes_to_host = 0;
port->nbytes_to_port_bridge = 0;
spin_unlock_irqrestore(&port->port_lock, flags);