diff options
| author | Linaro CI <ci-bot@linaro.org> | 2021-11-25 21:04:37 +0000 |
|---|---|---|
| committer | Linaro CI <ci-bot@linaro.org> | 2021-11-25 21:04:37 +0000 |
| commit | f526c0862d6381a10060928da8cf10c0450e2faf (patch) | |
| tree | 868b4ad74a2c188e4e653931ee2c1a549e593d4f | |
| parent | 7c08af54c6cf7f88320601b99e7b38a68f9d213d (diff) | |
| parent | 79ae2af2010acdbcb54b5a2cba6e05c8a8017966 (diff) | |
| download | omap-4.19.217-79ae2af2010a-20211125-377.tar.gz | |
Merge remote-tracking branch 'aosp/android-4.19-stable' into android-beagle-x15-4.19-stable-lkft4.19.217-79ae2af2010a-20211125-377
* aosp/android-4.19-stable:
ANDROID: usb: gadget: f_accessory: Mitgate handling of non-existent USB request
| -rw-r--r-- | drivers/usb/gadget/function/f_accessory.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/drivers/usb/gadget/function/f_accessory.c b/drivers/usb/gadget/function/f_accessory.c index 718e01e3190f..b6adf7d803ef 100644 --- a/drivers/usb/gadget/function/f_accessory.c +++ b/drivers/usb/gadget/function/f_accessory.c @@ -601,8 +601,11 @@ fail: pr_err("acc_bind() could not allocate requests\n"); while ((req = req_get(dev, &dev->tx_idle))) acc_request_free(req, dev->ep_in); - for (i = 0; i < RX_REQ_MAX; i++) + for (i = 0; i < RX_REQ_MAX; i++) { acc_request_free(dev->rx_req[i], dev->ep_out); + dev->rx_req[i] = NULL; + } + return -1; } @@ -634,6 +637,12 @@ static ssize_t acc_read(struct file *fp, char __user *buf, goto done; } + if (!dev->rx_req[0]) { + pr_warn("acc_read: USB request already handled/freed"); + r = -EINVAL; + goto done; + } + /* * Calculate the data length by considering termination character. * Then compansite the difference of rounding up to @@ -1098,8 +1107,10 @@ acc_function_unbind(struct usb_configuration *c, struct usb_function *f) while ((req = req_get(dev, &dev->tx_idle))) acc_request_free(req, dev->ep_in); - for (i = 0; i < RX_REQ_MAX; i++) + for (i = 0; i < RX_REQ_MAX; i++) { acc_request_free(dev->rx_req[i], dev->ep_out); + dev->rx_req[i] = NULL; + } acc_hid_unbind(dev); } |