From 8b51dad4aa30bccceddb8bbf4d1ed88ad8f2c119 Mon Sep 17 00:00:00 2001 From: Mayank Rana Date: Fri, 30 Oct 2020 13:03:20 -0700 Subject: [PATCH] usb: gadget: qdss: Add NULL check against channel with usb_qdss_free_req() USB requests are being freed from 2 context from Linux QDSS driver: 1. usb_qdss_close() 2. explicitly calling usb_free_request() on receiving USB_QDSS_DISCONNECT usb_qdss_close() is setting drvdata->usbch to NULL. Hence it ends up passing usbch as NULL while calling usb_free_request() when handling USB_QDSS_DISCONNECT. Fix this NULL pointer dereference issue by explicitly checking USB channel against NULL with usb_qdss_free_req(). Change-Id: Ia55a30b09ab1f94db15947b984fd232a33da7788 Signed-off-by: Mayank Rana --- drivers/usb/gadget/function/f_qdss.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/f_qdss.c b/drivers/usb/gadget/function/f_qdss.c index b0c12a699557..8d8ed9fb0812 100644 --- a/drivers/usb/gadget/function/f_qdss.c +++ b/drivers/usb/gadget/function/f_qdss.c @@ -256,12 +256,13 @@ void usb_qdss_free_req(struct usb_qdss_ch *ch) unsigned long flags; spin_lock_irqsave(&channel_lock, flags); - qdss = ch->priv_usb; - if (!qdss) { + if (ch == NULL || ch->priv_usb == NULL) { spin_unlock_irqrestore(&channel_lock, flags); - pr_err("%s: qdss ctx is NULL\n", __func__); + pr_err("%s: qdss channel or qdss ctx is NULL\n", __func__); return; } + + qdss = ch->priv_usb; spin_unlock_irqrestore(&channel_lock, flags); spin_lock_irqsave(&qdss->lock, flags);