diff options
| author | Bryan O'Donoghue <bryan.odonoghue@linaro.org> | 2020-01-09 13:17:22 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-02-14 16:30:59 -0500 |
| commit | 5feb24e33bc136a1e18d94281097b8b5d87906cf (patch) | |
| tree | c504dbf1ea57d630ada507d8c7213e4c7f4224e6 /sound | |
| parent | a5299a177e70da1bc7993177ce272f23bbd5b36d (diff) | |
usb: gadget: f_ecm: Use atomic_t to track in-flight request
commit d710562e01c48d59be3f60d58b7a85958b39aeda upstream.
Currently ecm->notify_req is used to flag when a request is in-flight.
ecm->notify_req is set to NULL and when a request completes it is
subsequently reset.
This is fundamentally buggy in that the unbind logic of the ECM driver will
unconditionally free ecm->notify_req leading to a NULL pointer dereference.
Fixes: da741b8c56d6 ("usb ethernet gadget: split CDC Ethernet function")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'sound')
0 files changed, 0 insertions, 0 deletions