diff options
| author | guoyin.chen <guoyin.chen@freescale.com> | 2014-07-31 08:54:34 +0800 |
|---|---|---|
| committer | guoyin.chen <guoyin.chen@freescale.com> | 2014-07-31 15:49:32 +0800 |
| commit | 4228b09395fa1700e75bd33758d1e2318baffbca (patch) | |
| tree | 391283d2f358022a998cb94c50f6a3145d72a4aa | |
| parent | b1fde98163647702f878ace02de74c8d45819b98 (diff) | |
ENGR00322643-2 WFD between source and sink lost if disable USB tethering
In rndis_unbind(struct usb_configuration *c, struct usb_function *f),
it will free the rndis->notify_req and rndis.
But the rndis_response_available(void *_rndis) still will access
the rndis and still summit notify_req to our usb ep.
Add checking on used in rndis_msg_parser to avoid this case.
Signed-off-by: guoyin.chen <guoyin.chen@freescale.com>
| -rw-r--r-- | drivers/usb/gadget/rndis.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c index 693f0c24d516..ac0d59940899 100644 --- a/drivers/usb/gadget/rndis.c +++ b/drivers/usb/gadget/rndis.c @@ -805,7 +805,8 @@ int rndis_msg_parser(u8 configNr, u8 *buf) MsgType = get_unaligned_le32(tmp++); MsgLength = get_unaligned_le32(tmp++); - if (configNr >= RNDIS_MAX_CONFIGS) + if ((configNr >= RNDIS_MAX_CONFIGS) || + (rndis_per_dev_params[configNr].used == 0)) return -ENOTSUPP; params = &rndis_per_dev_params[configNr]; |