RE: [EXTERNAL] Re: Kernel patch in USB 4.4.138 Version

["Varadarajan, Kiruthika" <Kiruthika.Varadarajan@harman.com>]

[-- Attachment #1: Type: text/plain, Size: 938 bytes --]

Hi Greg,
 Now I ran checkpatch and this patch is against kernel version 5.1.
 Checkpatch run is clean. Could you check my patch now.

Thanks and Regards,
Kiruthika. NV

-----Original Message-----
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Sent: Tuesday, June 18, 2019 3:18 PM
To: Varadarajan, Kiruthika <Kiruthika.Varadarajan@harman.com>
Cc: Felipe Balbi <balbi@ti.com>; linux-usb@vger.kernel.org; linux-kernel@vger.kernel.org; kiruthikanv@gmail.com
Subject: Re: [EXTERNAL] Re: Kernel patch in USB 4.4.138 Version

On Tue, Jun 18, 2019 at 08:43:56AM +0000, Varadarajan, Kiruthika wrote:
> Hi Greg,
>  Please ignore my previous email and here is the patch on top of 4.4.x stable version.
>  Could you please review the attached patch.

Also, always use scripts/checkpatch.pl on your patch, it has a number of obvious coding style issues that prevent it from being accepted by anyone.

thanks,

greg k-h

[-- Attachment #2: USB-Fix-race-between-gether_disconnect-and-rx_submit.patch --]
[-- Type: application/octet-stream, Size: 1605 bytes --]

From 897fb2d0653b481b83d77685e4b20be702027afc Mon Sep 17 00:00:00 2001
From: kvaradarajan <Kiruthika.Varadarajan@harman.com>
Date: Tue, 18 Jun 2019 11:29:49 +0000
Subject: [PATCH]  USB: Fix race between gether_disconnect and rx_submit

  On spin lock release in rx_submit, gether_disconnect get
  a chance to run, it makes port_usb NULL, rx_submit access
  NULL port USB, hence null pointer crash.

  Fixed by releasing the lock in rx_submit after port_usb
  is used.

Signed-off-by: KVaradarajan <Kiruthika.Varadarajan@harman.com>
---
 drivers/usb/gadget/function/u_ether.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index 737bd77..76cf1e4 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -186,11 +186,11 @@ static void defer_kevent(struct eth_dev *dev, int flag)
 		out = dev->port_usb->out_ep;
 	else
 		out = NULL;
-	spin_unlock_irqrestore(&dev->lock, flags);
 
-	if (!out)
+	if (!out) {
+		spin_unlock_irqrestore(&dev->lock, flags);
 		return -ENOTCONN;
-
+	}
 
 	/* Padding up to RX_EXTRA handles minor disagreements with host.
 	 * Normally we use the USB "terminate on short read" convention;
@@ -215,6 +215,7 @@ static void defer_kevent(struct eth_dev *dev, int flag)
 	if (dev->port_usb->is_fixed)
 		size = max_t(size_t, size, dev->port_usb->fixed_out_len);
 
+	spin_unlock_irqrestore(&dev->lock, flags);
 	skb = __netdev_alloc_skb(dev->net, size + NET_IP_ALIGN, gfp_flags);
 	if (skb == NULL) {
 		DBG(dev, "no rx skb\n");
-- 
1.9.1