From 7df933d7a9e827c3b91a5334b15233fc1f5c0208 Mon Sep 17 00:00:00 2001 From: Ajay Agarwal Date: Thu, 6 Aug 2020 17:34:56 +0530 Subject: [PATCH] usb: gadget: u_ether: Add skb check in eth_start_xmit 'Commit 145c3d9be206 ("usb: u_ether: Prevent dropping multicast packet in rmnet ip mode")' removed skb check from eth_start_xmit function. While ndo_start_xmit are typically expected never to be called with NULL SKBs, for NCM function this xmit function is called with NULL SKB initially which then uses the 'wrap' routine to create valid SKBs. But this null SKB is getting dereferenced before 'wrap' routine could run on it when in ethernet mode. Fix this by bringing in the skb check. Change-Id: I9d40f70190eb91ecc848b71c4ce31a656c60a28d Signed-off-by: Ajay Agarwal --- drivers/usb/gadget/function/u_ether.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c index 051469887a5a..d52f13df28e2 100644 --- a/drivers/usb/gadget/function/u_ether.c +++ b/drivers/usb/gadget/function/u_ether.c @@ -490,7 +490,7 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, } spin_unlock_irqrestore(&dev->lock, flags); - if (!in) { + if (skb && !in) { dev_kfree_skb_any(skb); return NETDEV_TX_OK; } @@ -547,15 +547,15 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, if (dev->port_usb) skb = dev->wrap(dev->port_usb, skb); spin_unlock_irqrestore(&dev->lock, flags); - if (!skb) { - /* Multi frame CDC protocols may store the frame for - * later which is not a dropped frame. - */ - if (dev->port_usb && - dev->port_usb->supports_multi_frame) - goto multiframe; - goto drop; - } + } + if (!skb) { + /* Multi frame CDC protocols may store the frame for + * later which is not a dropped frame. + */ + if (dev->port_usb && + dev->port_usb->supports_multi_frame) + goto multiframe; + goto drop; } length = skb->len;