Fix potential oops on rare error path. The patch is based on commit e7b13ec9235b9fded90f826ceeb8c34548631351 (done by David Brownell david-b@pacbell.net) from linux-2.6.git.
Description of the issue taken from linux kernel bugzilla: (https://bugzilla.kernel.org/show_bug.cgi?id=9594)
The potential error can be tracked down as follows:
(1) line 807: let the second conjunct on the "if" statment be false meaning "dev->status_ep" is null. This means the "if" evaluates to false.
follow thru the code until...
(2) line 808: usb_ep_disable(dev->status_ep) passes in a null argument, however "usb_ep_disable" cannot handle that:
(from include/linux/usb/gadget.h) 191 static inline int 192 usb_ep_disable (struct usb_ep *ep) 193 { 194 return ep->ops->disable (ep); 195 }
--
Signed-off-by: Vitaly Kuzmichev vkuzmichev@mvista.com --- drivers/usb/gadget/ether.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c index 03d8f0b..62dd008 100644 --- a/drivers/usb/gadget/ether.c +++ b/drivers/usb/gadget/ether.c @@ -804,7 +804,7 @@ done:
/* on error, disable any endpoints */ if (result < 0) { - if (!subset_active(dev)) + if (!subset_active(dev) && dev->status_ep) (void) usb_ep_disable (dev->status_ep); dev->status = NULL; (void) usb_ep_disable (dev->in_ep);