From patchwork Thu Jun 30 09:10:23 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "\(Exiting\) Baolin Wang" X-Patchwork-Id: 71226 Delivered-To: patch@linaro.org Received: by 10.140.28.4 with SMTP id 4csp287788qgy; Thu, 30 Jun 2016 02:11:03 -0700 (PDT) X-Received: by 10.98.18.9 with SMTP id a9mr19655341pfj.14.1467277863373; Thu, 30 Jun 2016 02:11:03 -0700 (PDT) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id bw10si3556663pab.179.2016.06.30.02.11.03; Thu, 30 Jun 2016 02:11:03 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752049AbcF3JK6 (ORCPT + 30 others); Thu, 30 Jun 2016 05:10:58 -0400 Received: from mail-pa0-f51.google.com ([209.85.220.51]:33782 "EHLO mail-pa0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751575AbcF3JKz (ORCPT ); Thu, 30 Jun 2016 05:10:55 -0400 Received: by mail-pa0-f51.google.com with SMTP id b13so26649259pat.0 for ; Thu, 30 Jun 2016 02:10:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=TQA+BxwE0l1Jh89SsH76MTUb4g+j1vigkUyWdpgMSoY=; b=LjNJxflG6j2poYFre/17TA5PTmeG3uS2XSFGfp1DyDqFyYFGSaivDBjRq7uWo6GyXL PlnXvdLD9gdJgGs/SXPkMKrHi5wRnQIqMtKULY0pSRBMt0N2TGbNb1h9OENPHoH6PFqk FUlXREiMkgZ8+0i/RizEfQWKW5t14+s+mGHTA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=TQA+BxwE0l1Jh89SsH76MTUb4g+j1vigkUyWdpgMSoY=; b=eS5yAcjd5hkGGrWl1qVVQncmKYYwNSmxpsDC4KDWfFbW6eTK2+StTlW3J/UafjVi5B szcmjJJC+zh+M+PnQCN7o7j0c2nu72r3uTJaU8TFm0euVVJfO6ss0Hrz1kmNFIkZmCIY 4oAY/WusDPzGZJw3kGONIQoXUcklINSc6uif0bMt4ci+Ys+FeNqohhsr7FET/yh5bmG+ qW8uodKaqTEE9URbGsCEjdaJDIDVQpoaeagPVsIq9T0JJHebP3jOoFHQAfq/3Np8dGqZ OhfmLee1C8MyCqkqRABW2n+AUTdwOToD8CpqHo9jJdz8GQ2ogMM57wxkLEko4+cdjJnM Yg/Q== X-Gm-Message-State: ALyK8tJFrJOPrvJ6XUlpImURXZKPGZoScPvNCiMFtNSk+Ikk+HU9XGv3cgCDoueAS9nCEt/a X-Received: by 10.66.47.100 with SMTP id c4mr17407482pan.105.1467277854916; Thu, 30 Jun 2016 02:10:54 -0700 (PDT) Received: from baolinwangubtpc.spreadtrum.com ([175.111.195.49]) by smtp.gmail.com with ESMTPSA id um7sm3905896pab.20.2016.06.30.02.10.52 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 30 Jun 2016 02:10:54 -0700 (PDT) From: Baolin Wang To: balbi@kernel.org, gregkh@linuxfoundation.org Cc: peter@hurleysoftware.com, r.baldyga@samsung.com, broonie@kernel.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, baolin.wang@linaro.org Subject: [PATCH] usb: gadget: Add the gserial port checking in gs_start_tx() Date: Thu, 30 Jun 2016 17:10:23 +0800 Message-Id: <11cb15ff2587d4f38f72bfdb3d5650144ba150ef.1467277321.git.baolin.wang@linaro.org> X-Mailer: git-send-email 1.7.9.5 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When usb gadget is set gadget serial function, it will be crash in below situation. It will clean the 'port->port_usb' pointer in gserial_disconnect() function when usb link is inactive, but it will release lock for disabling the endpoints in this function. Druing the lock release period, it maybe complete one request to issue gs_write_complete()--->gs_start_tx() function, but the 'port->port_usb' pointer had been set NULL, thus it will be crash in gs_start_tx() function. This patch adds the 'port->port_usb' pointer checking in gs_start_tx() function to avoid this situation. Signed-off-by: Baolin Wang --- drivers/usb/gadget/function/u_serial.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) -- 1.7.9.5 diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index 3580f19..66a0910 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -375,10 +375,15 @@ __acquires(&port->port_lock) */ { struct list_head *pool = &port->write_pool; - struct usb_ep *in = port->port_usb->in; + struct usb_ep *in; int status = 0; bool do_tty_wake = false; + if (!port->port_usb) + return status; + + in = port->port_usb->in; + while (!port->write_busy && !list_empty(pool)) { struct usb_request *req; int len;