usb: gadget: u_ether: Fix NULL pointer dereferences after gadget unbind

[PATCH 0/2] usb: gadget: u_ether: Fix NULL pointer dereferences after gadget unbind

Kuen-Han Tsai posted 2 patches 1 day, 5 hours ago

Download series mbox

drivers/usb/gadget/function/u_ether.c | 84 ++++++++++++++++++-----------------
1 file changed, 44 insertions(+), 40 deletions(-)

Expand all Fold all

[PATCH 0/2] usb: gadget: u_ether: Fix NULL pointer dereferences after gadget unbind

Posted by Kuen-Han Tsai 1 day, 5 hours ago

Hi all,

This series fixes two NULL pointer dereference issues in u_ether after
the gadget is unbound and dev->gadget is cleared by
gether_detach_gadget():

- Patch 1 replaces the composite.h DBG()/VDBG()/ERROR()/INFO() macros in
  u_ether.c with netdev_*() helpers so debug logging does not 
  dereference dev->gadget when the net_device is detached from the
  gadget.
- Patch 2 extends dev->lock to serialize dev->gadget accesses across
  eth_get_drvinfo(), rx_submit(), gether_set_gadget(), and
  gether_detach_gadget(), closing a check-then-use race in
  eth_get_drvinfo().

Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
---
Kuen-Han Tsai (2):
      usb: gadget: u_ether: Fix NULL pointer deref in debug logging
      usb: gadget: u_ether: Protect dev->gadget access with dev->lock

 drivers/usb/gadget/function/u_ether.c | 84 ++++++++++++++++++-----------------
 1 file changed, 44 insertions(+), 40 deletions(-)
---
base-commit: abc36cbda29d8f19cf3a580cd86ca9e865186a41
change-id: 20260923-u-ether-gadget-npe-2fddafb37f23

Best regards,
-- 
Kuen-Han Tsai <khtsai@google.com>