rubenslte/android_kernel_samsung_msm8226
1
Fork 1
mirror of https://github.com/LineageOS/android_kernel_samsung_msm8226.git synced 2026-09-28 00:00:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

usb: gadget: f_mtp: Fix issue of NULL pointer access in mtp_read

Browse Source 
MTP usb device node created as a part of mtp function init call.
Userspace can read/write to MTP device using this node. If MTP is
not enabled in the composition and trying to read mtp_usb dev node
from the userspace leading to null pointer access in mtp_read.

Do not access ep OUT maxpacket size in mtp_read. First block on mtp_read
until the state become online which doesn't wakeup from the thread and
expecting for the read completion or state change which occurs as
a part of set_alt.

Change-Id: Icbee5fe7ae2c02b2bca185a0dc7587eb4940058a
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Signed-off-by: Azhar Shaikh <azhars@codeaurora.org>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
This commit is contained in:
ChandanaKishori Chiluveru
2020-09-23 18:04:29 +02:00
committed by Francescodario Cuzzocrea
parent e983b9ef0d
commit c7a35c9488
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/usb/gadget/f_mtp.c
+5 -5
View File
@@ -563,11 +563,6 @@ static ssize_t mtp_read(struct file *fp, char __user *buf,
DBG(cdev, "mtp_read(%d)\n", count);
len = ALIGN(count, dev->ep_out->maxpacket);
if (len > mtp_rx_req_len)
return -EINVAL;
/* we will block until we're online */
DBG(cdev, "mtp_read: waiting for online state\n");
ret = wait_event_interruptible(dev->read_wq,
@@ -576,6 +571,11 @@ static ssize_t mtp_read(struct file *fp, char __user *buf,
r = ret;
goto done;
}
len = ALIGN(count, dev->ep_out->maxpacket);
if (len > mtp_rx_req_len)
return -EINVAL;
spin_lock_irq(&dev->lock);
if (dev->state == STATE_CANCELED) {
/* report cancelation to userspace */