| Message ID | 1379647780-2623-5-git-send-email-troy.kisky@boundarydevices.com |
|---|---|
| State | Superseded |
| Delegated to: | Marek Vasut |
| Headers | show |
Dear Troy Kisky, > This prevents a crash if tftpboot is given a bad filename. > > rx_req will be released by eth_reset_config > which is called by eth_disconnect, > which is called using the .disconnect member of usb_gadget_driver by > mv_pullup in mv_udc which is called using the .pullup member of > usb_gadget_ops by usb_gadget_disconnect which is called by usb_eth_halt > which is called using the .halt member of eth_device by eth_halt > which is called by TftpHandler when TFTP_ERR_FILE_NOT_FOUND or > TFTP_ERR_ACCESS_DENIED occurs > > Signed-off-by: Troy Kisky <troy.kisky@boundarydevices.com> > How do I trigger this? It'd be nice to have a test-case in the commit message. Best regards, Marek Vasut
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c index 988cffb..cc6cc1f 100644 --- a/drivers/usb/gadget/ether.c +++ b/drivers/usb/gadget/ether.c @@ -1536,6 +1536,8 @@ static int rx_submit(struct eth_dev *dev, struct usb_request *req, */ debug("%s\n", __func__); + if (!req) + return -EINVAL; size = (ETHER_HDR_SIZE + dev->mtu + RX_EXTRA); size += dev->out_ep->maxpacket - 1;
This prevents a crash if tftpboot is given a bad filename. rx_req will be released by eth_reset_config which is called by eth_disconnect, which is called using the .disconnect member of usb_gadget_driver by mv_pullup in mv_udc which is called using the .pullup member of usb_gadget_ops by usb_gadget_disconnect which is called by usb_eth_halt which is called using the .halt member of eth_device by eth_halt which is called by TftpHandler when TFTP_ERR_FILE_NOT_FOUND or TFTP_ERR_ACCESS_DENIED occurs Signed-off-by: Troy Kisky <troy.kisky@boundarydevices.com> --- v4: expanded commit message --- drivers/usb/gadget/ether.c | 2 ++ 1 file changed, 2 insertions(+)