Patchwork [U-Boot,V4,04/17] usb: gadget: ether: return error from rx_submit if no request

login
register
mail settings
Submitter Troy Kisky
Date Sept. 20, 2013, 3:29 a.m.
Message ID <1379647780-2623-5-git-send-email-troy.kisky@boundarydevices.com>
Download mbox | patch
Permalink /patch/276197/
State Superseded
Delegated to: Marek Vasut
Headers show

Comments

Troy Kisky - Sept. 20, 2013, 3:29 a.m.
This prevents a crash if tftpboot is given a bad filename.

rx_req will be released by eth_reset_config
which is called by eth_disconnect,
which is called using the .disconnect member of usb_gadget_driver by mv_pullup in mv_udc
which is called using the .pullup member of usb_gadget_ops by usb_gadget_disconnect
which is called by usb_eth_halt
which is called using the .halt member of eth_device by eth_halt
which is called by TftpHandler when TFTP_ERR_FILE_NOT_FOUND or TFTP_ERR_ACCESS_DENIED occurs

Signed-off-by: Troy Kisky <troy.kisky@boundarydevices.com>

---
v4: expanded commit message
---
 drivers/usb/gadget/ether.c | 2 ++
 1 file changed, 2 insertions(+)
Marek Vasut - Sept. 20, 2013, 10:52 a.m.
Dear Troy Kisky,

> This prevents a crash if tftpboot is given a bad filename.
> 
> rx_req will be released by eth_reset_config
> which is called by eth_disconnect,
> which is called using the .disconnect member of usb_gadget_driver by
> mv_pullup in mv_udc which is called using the .pullup member of
> usb_gadget_ops by usb_gadget_disconnect which is called by usb_eth_halt
> which is called using the .halt member of eth_device by eth_halt
> which is called by TftpHandler when TFTP_ERR_FILE_NOT_FOUND or
> TFTP_ERR_ACCESS_DENIED occurs
> 
> Signed-off-by: Troy Kisky <troy.kisky@boundarydevices.com>
> 

How do I trigger this? It'd be nice to have a test-case in the commit message.

Best regards,
Marek Vasut

Patch

diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index 988cffb..cc6cc1f 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -1536,6 +1536,8 @@  static int rx_submit(struct eth_dev *dev, struct usb_request *req,
 	 */
 
 	debug("%s\n", __func__);
+	if (!req)
+		return -EINVAL;
 
 	size = (ETHER_HDR_SIZE + dev->mtu + RX_EXTRA);
 	size += dev->out_ep->maxpacket - 1;