diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2016-09-17 21:07:17 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-09-17 21:07:16 -0700 |
| commit | a8db147fc1a50bda1cd501a2d294a693036ad92c (patch) | |
| tree | 71741025705ca1f39b9a9997f6f03382b2c3f950 | |
| parent | f18d5b789d9bef558fd5b828f2a60d121ce8149f (diff) | |
| parent | 7b82923158dad0688ad3848ae3bbb092ad12cb1b (diff) | |
Merge "USB: f_accessory: Fix NULL pointer dereference in acc_read()"
| -rw-r--r-- | drivers/usb/gadget/function/f_accessory.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/usb/gadget/function/f_accessory.c b/drivers/usb/gadget/function/f_accessory.c index 2f6f393ba7c9..bc1c34f05fa3 100644 --- a/drivers/usb/gadget/function/f_accessory.c +++ b/drivers/usb/gadget/function/f_accessory.c @@ -629,8 +629,6 @@ static ssize_t acc_read(struct file *fp, char __user *buf, if (count > BULK_BUFFER_SIZE) count = BULK_BUFFER_SIZE; - len = ALIGN(count, dev->ep_out->maxpacket); - /* we will block until we're online */ pr_debug("acc_read: waiting for online\n"); ret = wait_event_interruptible(dev->read_wq, dev->online); @@ -639,6 +637,8 @@ static ssize_t acc_read(struct file *fp, char __user *buf, goto done; } + len = ALIGN(count, dev->ep_out->maxpacket); + if (dev->rx_done) { // last req cancelled. try to get it. req = dev->rx_req[0]; |