usb: gadget: eliminate NULL pointer dereference (bugfix)
usb: gadget: eliminate NULL pointer dereference (bugfix) This patch fixes a bug which causes NULL pointer dereference in ffs_ep0_ioctl. The bug happens when the FunctionFS is not bound (either has not been bound yet or has been bound and then unbound) and can be reproduced with running the following commands: $ insmod g_ffs.ko $ mount -t functionfs func /dev/usbgadget $ ./null where null.c is: #include <fcntl.h> #include <linux/usb/functionfs.h> int main(void) { int fd = open("/dev/usbgadget/ep0", O_RDWR); ioctl(fd, FUNCTIONFS_CLEAR_HALT); return 0; } Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> Cc: stable@vger.kernel.org Signed-off-by: Felipe Balbi <balbi@ti.com>
This commit is contained in:
parent
6190c79df8
commit
92b0abf80c
|
@ -712,7 +712,7 @@ static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
|
|||
if (code == FUNCTIONFS_INTERFACE_REVMAP) {
|
||||
struct ffs_function *func = ffs->func;
|
||||
ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
|
||||
} else if (gadget->ops->ioctl) {
|
||||
} else if (gadget && gadget->ops->ioctl) {
|
||||
ret = gadget->ops->ioctl(gadget, code, value);
|
||||
} else {
|
||||
ret = -ENOTTY;
|
||||
|
|
Loading…
Reference in a new issue