From patchwork Fri Mar 22 15:44:07 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 160929 Delivered-To: patch@linaro.org Received: by 2002:a02:c6d8:0:0:0:0:0 with SMTP id r24csp962054jan; Fri, 22 Mar 2019 08:47:53 -0700 (PDT) X-Google-Smtp-Source: APXvYqynzNO4HfNWK9VGro1LPQa47UsM3H8exRi25QaAsNxMSV5yE/dAKXWYJ34CzCauZH7Vqv97 X-Received: by 2002:a17:902:e113:: with SMTP id cc19mr10540207plb.179.1553269673214; Fri, 22 Mar 2019 08:47:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553269673; cv=none; d=google.com; s=arc-20160816; b=EtypxMc1H+mxdG5Q6gKFDc/fGT/az8qmyZdMUn36QALkvcaLVdwgg8mtCMXgdjV7ez 5fGmcm5zIkFkXLP4VGXaLzso2fXMhrfPuxXag6qFsO/gT9LpuBtVk8sGh+2a9uYy+qhr hI9JIRGWh1lygE0fPkA8z8eMvN0HyyQrJiM/8m15H+3AJ8awWSu6s8JIi2jwgtu0x3fy Xz23oLVUYbe+syBFQTd66k8V9dIpyjYRmtNJ4S1LHTm8l9gGpnyPivebKHmAZJ4wGtjq Sgpr61MKqug2eBk0VT08ZdaPWeRPyR94QFnMgvIZYuLrjdeS0LdtHwWzcHDl9ohmUobq 2HhQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=n3gm47iQrRnfMZaFz/RppgS8DX70VH/pJUoRLU2/GXM=; b=nAHBG6t6PYQ2fDA0UbBUquvyewR3IvOgyxoNWRJ7wSUIXJjZzvXa5yBo8e7o8nuf/j YSKCkn9FeKBzxAC4l/RIZiKvGN18Y4g9g+InPi5CRjYjkunff6u2rFUdabWqJQX7vIq+ bDATX7n4p3zUR+Axba3lhZPe5szY4W1ahdQgG9o5AC5LU3jJ4s0pY4mGpVSS8C27D0bn QYc82zqGG/jCVEmsqK7rPFa7QGlf9hOFjMUJrOt4+lcVhtFvdHTkRNERA5xLjd5XPLsi KkGavEf3nMELYmjV3UoTl95ZFsnwMwmYLcndUv6vGthfC28Vy9h5GJMDcXRRG9FIVhBr vqTw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a4si6745015pgq.471.2019.03.22.08.47.52; Fri, 22 Mar 2019 08:47:53 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727565AbfCVPrw (ORCPT + 14 others); Fri, 22 Mar 2019 11:47:52 -0400 Received: from mout.kundenserver.de ([217.72.192.73]:47809 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727509AbfCVPrw (ORCPT ); Fri, 22 Mar 2019 11:47:52 -0400 Received: from wuerfel.lan ([149.172.19.189]) by mrelayeu.kundenserver.de (mreue108 [212.227.15.145]) with ESMTPA (Nemesis) id 1MjjKf-1gjc5b16ZX-00lE5J; Fri, 22 Mar 2019 16:47:44 +0100 From: Arnd Bergmann To: stable@vger.kernel.org, Felipe Balbi , Greg Kroah-Hartman , =?utf-8?q?Micha=C5=82_Mir?= =?utf-8?b?b3PFgmF3?= Cc: Baolin Wang , Felipe Balbi , Arnd Bergmann , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [BACKPORT 4.4.y 16/25] usb: gadget: Add the gserial port checking in gs_start_tx() Date: Fri, 22 Mar 2019 16:44:07 +0100 Message-Id: <20190322154425.3852517-17-arnd@arndb.de> X-Mailer: git-send-email 2.20.0 In-Reply-To: <20190322154425.3852517-1-arnd@arndb.de> References: <20190322154425.3852517-1-arnd@arndb.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:Gosm4FGMsO5444Yg2Rf0+LQ/wGhky3Ep9nyBnNCh3iX2HcC7Jqm QRhr2Wo5HVbg+g+U9ybx4brDFsuOPqV7XrvydvCQnY4KLVEkg7chK9/opsptLw/KnBaK7dT 6Ws8K+2CsaWRWoF8ewFtCYh2/J7Tv6abQ5bCXh8/7zQdFfZ1DtMb9E6UD6ccANR3CXSelrD 05HW0XW+xnWmFMNdqqfMQ== X-Spam-Flag: NO X-UI-Out-Filterresults: notjunk:1; V03:K0:sMKRZ0XQZVQ=:m7r/UvufhblTmUzBYkZa5q p4hpUgO2sRWcQOukcKg1UBbA2a+XFUqXPmjT907LUZO9rvBGleAUvIiWLuWNku+4oOmiAvrx+ Z6FPAmd6D/ctYxYRwXN9azzPSqdW4RrehZxWqlrQduuSSacQbIsSZ1N4AYoyNyJzQYwC6BmQ/ nRJGbdnjoHkec07CiGgZE+6quYmo9y8ccATf54sJTC9r1c1nAliTkEuH0mT4yfZ4UXxjWXjgC TUxQaS85HwprcBwB44xlGNMV9aXMJAedeL1LcPu7giVCooKl2g+nfMKRopj2FyLz7wfmDqzKV Ca8IRLmbHpwhdi8tZP5B4XCYiq1tsbqO88RDbKZfWwo+YuBE35reFZjWZOZkTp5WBcKudH3dC 49sRlU6jVz7hHoqZpBBwFA/7gQ8SYSytHfK8NsDd7XGWCIDhFBM5P5vP2eFhVjoTmzNFR3nS2 fVSYqZUPEAHu3Bl6eB+kD/rTjbNwnHL7MsITEe+5nwiNdMHcUJlXEbfjKiE82TVajMjcue5ty nHwawyh8mHiuyXeXhy43p9lbphOK+oKNHrdbQCFki3meHMdldT+cPIYR6DQTwncAr/mBr/00w QWKQnazP6vBd9EI7zjUInvBQtZ2i6JcYznstgP0Ek7n80nidh8V08N+l/2bkpNTiRdrsmQX9r 6W3UO6Eag30fipuj+mDBp1apgRYQshK22Bcz3U4j3wUMcAkCMR0kKaeGg0EH3DiiYdUwTX2At QQiRhmmFr20T5i6fb5s9N8zMq6yOksSjaC6iRw== Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Baolin Wang When usb gadget is set gadget serial function, it will be crash in below situation. It will clean the 'port->port_usb' pointer in gserial_disconnect() function when usb link is inactive, but it will release lock for disabling the endpoints in this function. Druing the lock release period, it maybe complete one request to issue gs_write_complete()--->gs_start_tx() function, but the 'port->port_usb' pointer had been set NULL, thus it will be crash in gs_start_tx() function. This patch adds the 'port->port_usb' pointer checking in gs_start_tx() function to avoid this situation. Signed-off-by: Baolin Wang Signed-off-by: Felipe Balbi (cherry picked from commit 511a36d2f357724312bb3776d2f6eed3890928b2) Signed-off-by: Arnd Bergmann --- drivers/usb/gadget/function/u_serial.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) -- 2.20.0 diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index 4ea44f7122ee..d73618475664 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -361,10 +361,15 @@ __acquires(&port->port_lock) */ { struct list_head *pool = &port->write_pool; - struct usb_ep *in = port->port_usb->in; + struct usb_ep *in; int status = 0; bool do_tty_wake = false; + if (!port->port_usb) + return status; + + in = port->port_usb->in; + while (!port->write_busy && !list_empty(pool)) { struct usb_request *req; int len;