evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

usb: dwc3: Fix NULL ptr dereference in ep disable ops

Browse source 
In RNDIS composition when windows PC is suspended RNDIS
driver sends flow control enable which frees the trb pool
of the RNDIS endpoints and trb pool pointer is set to NULL.
When bus suspend happens RNDIS gsi driver performs endpoint
disable operation because remote wake up is disabled. Endpoint
disable perform memset 0 on trb pool which is already set to
NULL causing the NULL pointer dereference. Fix this by adding
NULL check for trb pool before doing memset 0.

CRs-Fixed: 1044799
Change-Id: I2a233e85139be0612314e6fa3dfa1d1c0fa04547
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
This commit is contained in:
Hemant Kumar 2016-07-21 13:54:54 -07:00
parent 9e4b3ba4af
commit c24e9fe614
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/usb/dwc3/gadget.c
View file

@ -723,7 +723,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep)
* due to stale trbs with HWO bit set from previous composition when update * due to stale trbs with HWO bit set from previous composition when update
* transfer cmd is issued. * transfer cmd is issued.
*/ */
if (dep->number > 1) { if (dep->number > 1 && dep->trb_pool) {
memset(&dep->trb_pool[0], 0, memset(&dep->trb_pool[0], 0,
sizeof(struct dwc3_trb) * dep->num_trbs); sizeof(struct dwc3_trb) * dep->num_trbs);
dbg_event(dep->number, "Clr_TRB", 0); dbg_event(dep->number, "Clr_TRB", 0);