From patchwork Tue Dec 3 12:14:16 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?b?6IOh6L+e5Yuk?= X-Patchwork-Id: 13892302 Received: from APC01-TYZ-obe.outbound.protection.outlook.com (mail-tyzapc01on2060.outbound.protection.outlook.com [40.107.117.60]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F288E1E500F; Tue, 3 Dec 2024 12:14:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.117.60 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733228063; cv=fail; b=n/QaxcrGrp9AqVklsHuqfvFJSlbTg5s5kCX6ExhVWnuFSKrJfnXIOWX/dcm94wNRozTohdsig/yMTk1yx5MhzcVjcm7XnNlLS7WXdlvOTSDnohNckmUGywQ5kkCBrwZauwYsP9nf61jPUA3pPFNzJoYhpAkhzkYDt8IqPuXO1Jk= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733228063; c=relaxed/simple; bh=cPDQp4fRZr0Q9Ch110JzgbHSwxSMW1hMTLvuP4tJAII=; h=From:To:CC:Subject:Date:Message-ID:Content-Type:MIME-Version; b=ZDz/kaoUtKZ+rt3fw6maiOTH+mSjpFTXql33stXn2k6SUkJNwjW1V6Wdt1btKvqqDCl8XxiH/ENY87dw9thK790U/NUNjKGkXyO+TjIT9xc+po/p73fBMCDv0E+GLNoSVQjg0JaCu61aZ/WcwLKlKxiYmWhEOxJctFVanWGfGZI= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=vivo.com; spf=pass smtp.mailfrom=vivo.com; dkim=pass (2048-bit key) header.d=vivo.com header.i=@vivo.com header.b=HF5H66Qc; arc=fail smtp.client-ip=40.107.117.60 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=vivo.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=vivo.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=vivo.com header.i=@vivo.com header.b="HF5H66Qc" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=TUeacYTM2MEpPmseLHRajDdhwWlN3ZpEBSsSneNV0Yp9AHUjIExz2DfpTH+yfmUCCejK1GkPxGoZKupn+6rKOVQ8xT+ZrcmKv8vLBViJXnXTpCAqQolcgUygmN1ZJhqnhfmASnN2AwHgDk6VN8/7WgIYCcCqGY1yjOlzypIYDMeRmCKBvw5oim9nAh8W8tPPB9sgtT5cxFgkWtXa5x5SMBg2Rk2UkFuyyXmTcyO07Zyka2eX5K7Mln5E9PjF9E8KNZGoVmH/Z6FvAu6nX5MMzHsDuNF/9FqSwsy6mWyVze/e4I++c9S83mgOsY56f+kpfaMZoy9sQn6RTodu5JA6Qg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=cPDQp4fRZr0Q9Ch110JzgbHSwxSMW1hMTLvuP4tJAII=; b=b5R6Mede1MFw06dGtbBFLtF7vp6cXasCH8tXGKvfnK3e8CheViwEj+CP4q3I7pl1ZeOsNeQH2nWYZZmVW6EXBprG+hqrQHKSemZSetPFeMdj61XfOn7rwgY1WTIxnJQISr4y/F741Vr5RgzuH2kwhTiLM8B8wzcuu7iNwuOjhVdyFAkPg32fAihnRHhPkrwAtzT0Cc20JJkxa7T3cJCS7DDfrh/7gCBte2yRJ53e9i3iTJjLKIo/N+lJdr1BFQNnxQTexgz6we6r2xQQNK7iCj/Ig+LP2Rp+ODi5giWHfQa4eHHMwr3Wz2GniizAPlTABJxVlTrln9opq+s0YIRR6w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=vivo.com; dmarc=pass action=none header.from=vivo.com; dkim=pass header.d=vivo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vivo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cPDQp4fRZr0Q9Ch110JzgbHSwxSMW1hMTLvuP4tJAII=; b=HF5H66QcLgucCiOkfAqbpjcpAQIXta1rTWlS/2R02iyr0l9kBc+p/hwNij6QlS8RJ1tDvVZSWktqVoEgxjpoiOT2zHzLeUN59SpmK4XGwIo12YY7qEav9NBJCCR3I6FNNN+2o8YTIzZ2uwV2SDrKEVbw68AKDOv9iPBCPUbq6bpzXCmRn2SyeyZfQWziCDQVgv6xyVzF7OleGrWLCon9CGN8ej9LgAkl7dJ6Fp/iS9HQzO5m563v7C0cQ8PRj4qhU//HGtvn7e8Wyfht19pCRs2NXJLrapz8V1mcGGMTUV+kvN26Ht0lsvzzhMV5Kx2LaHzPAMsXifjCi/PzXb5IbA== Received: from TYUPR06MB6217.apcprd06.prod.outlook.com (2603:1096:400:358::7) by KL1PR06MB5882.apcprd06.prod.outlook.com (2603:1096:820:c8::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8230.6; Tue, 3 Dec 2024 12:14:16 +0000 Received: from TYUPR06MB6217.apcprd06.prod.outlook.com ([fe80::c18d:f7c6:7590:64fe]) by TYUPR06MB6217.apcprd06.prod.outlook.com ([fe80::c18d:f7c6:7590:64fe%6]) with mapi id 15.20.8230.008; Tue, 3 Dec 2024 12:14:16 +0000 From: =?eucgb2312_cn?b?uvrBrMfa?= To: "gregkh@linuxfoundation.org" , Prashanth K , "quic_jjohnson@quicinc.com" , "mwalle@kernel.org" CC: "linux-usb@vger.kernel.org" , "linux-kernel@vger.kernel.org" , opensource.kernel , =?eucgb2312_cn?b?uvrBrMfa?= Subject: [PATCH v4] usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer Thread-Topic: [PATCH v4] usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer Thread-Index: AdtFe+iVHwnkm4i8TKOizy92/U/fWQ== Date: Tue, 3 Dec 2024 12:14:16 +0000 Message-ID: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=vivo.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: TYUPR06MB6217:EE_|KL1PR06MB5882:EE_ x-ms-office365-filtering-correlation-id: a7148f79-bd64-4932-d27e-08dd13940205 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|366016|376014|38070700018; x-microsoft-antispam-message-info: =?eucgb2312_cn?b?RG9URVR0dGlUYmlMclhLT3dMRGVk?= =?eucgb2312_cn?b?eDlaejBwcmt3NnNBM29MZzZGME5IZStiN2xKK21SNlR6NHc3a3NxNmZUYm9kakhq?= =?eucgb2312_cn?b?bERsNUh0UURma2k3bTNDRDBwUzBqOENuUEZtaVFQZklQeDlnYWVhYm50UkZFelZo?= =?eucgb2312_cn?b?UHVpNStRaEFYdDE2a2ZYSEJUQWtGakp4WGt6SE03STRuemJqWC9EblJ0NjFtdUhp?= =?eucgb2312_cn?b?QTZPRGM5TzJObjAvSG91NFJFTG9DOHV2T1ZHcUo5MEtjL3VvNG9seW9SS2FSNEdk?= =?eucgb2312_cn?b?MFRDdVEwS1JuNk5wTkMzR0JmaERQdVBZbEc1d3ZlMmpmeERlVE9GQ2RLOXkwUHdi?= =?eucgb2312_cn?b?SlN5b1E3a2tZeEZGbWNIRkozOUQyVzZiL0NpaXBRZEdsSDZ5RzhlNVhjMUpqbUJU?= =?eucgb2312_cn?b?M0RFUW9NWjM4d2MzUi8vUHZWb21uQlJ4RW53MzM0RExQWnhtdmRpeUJqbnhsc0Z1?= =?eucgb2312_cn?b?Z3FSSVVOMmZUc2FOaEhSb0cxOTdQQlgwSUhnZ3Y2SVk3UCtqRFkydGM2VFJYSFAw?= =?eucgb2312_cn?b?cE95bEYrdVRYNitETXdEai9LZ3hJTHIzN3hKUld2WkR6VC92bWVsM0I4OXVJLzc5?= =?eucgb2312_cn?b?L2pUUTJCRmNaTzFCQlEwRVlBdHlPNk1TR0dKc21ZZ1hGT0NFUXNTNWZlMnRCZkdj?= =?eucgb2312_cn?b?TjhQL0FSQVhhdnRjUjJ5ejhmY01WSmpkdytNdzBFdVVHTnRBVUE2Qi9wc3h6bmZG?= =?eucgb2312_cn?b?NXdObVdDYlhDazRJMnd2U2QxZzBDd204SjByTW9Bc013YUxwNG9kcjI0SFg3bFVT?= =?eucgb2312_cn?b?YXJrQ1B5NmxkMmJNM0dHRGFDWjFudmVEN2QyQTdtQ3Z5czcxYUR4ekNrNjBBaHhu?= =?eucgb2312_cn?b?R0dsR0d5YTgxNmZlRGJVNUxJRERZRytsdEdOWmcveVZNekFvRnZqQWZpZjJtcGdC?= =?eucgb2312_cn?b?STZyQnlCaVdLN0ZBSTAzc0ZTNHVPdlBuQUtwc0hNdWFudnc1S3BXb25UeU1EV243?= =?eucgb2312_cn?b?c0lIblNobkdqaG05Z3FhamZkUkpHUmhjYklBTVV2dVdMNmxzcEhwcE1BSmtRcTFU?= =?eucgb2312_cn?b?M09xaVp6emM5KzVlWXVjeEpBU3hoaXBicnRlVDlsZVRFanZadytaTm5KZFMzRm5Y?= =?eucgb2312_cn?b?NlRwNTYyOVBqVkpVejh1eitKN0RnaCtva3QwYkxzVmNmVWlNeGtVOXBxY1QrZTlX?= =?eucgb2312_cn?b?Ukd4djc0QjczcWtEaU5BSGp4NzR1QVJTMGZFK2ozcmRRNTlYVXhtaEl2OVpiZ010?= =?eucgb2312_cn?b?RkQ2OWtoVi9mT2FKSTJ3cEp2bVBiYWhYYlQzYXVUL3RmMXFuVkxtdnFJWUlyQVEv?= =?eucgb2312_cn?b?SXo4ZEMza3F2R01uQjVnT2lEdy8vdTlwNkRPYWdnMUEwVENiNXpkSzduTnp6UmhI?= =?eucgb2312_cn?b?Y0xjQlBtZTlVeFRkdmR5SGRxT1oyZnkwT0dLRUkxa1lVL0taQ096SGI3b3hKQS80?= =?eucgb2312_cn?b?c3JRQ042ay9LRjNsOGFTL21xTXhBeUtIT1o5VkdNd3l3dTA0T2RjMkh5aGdMR3NO?= =?eucgb2312_cn?b?NXQzSUtRbDhTLy81WlF2RDhaUkM3QU14Qnp1T0tpM3VSSEdQcmxSbktma0M3WUhO?= =?eucgb2312_cn?b?MS83ZVowWDlMY2FhUnVkRWN3VW9UazlaMTRwWEtzWVBlZE9HSVdWWkNZMnJpSkxJ?= =?eucgb2312_cn?b?bHFuNmJUK01xN2ZlcGNpMDVMVzZjNjRsNkluQXg0NnZYdFd0YlhIU3VoUWxLSVZU?= =?eucgb2312_cn?b?ZG13VjllQVB3SEtYMU1CbUxzNUVXa25rWGlMSVMxL1hDbGdNR0FMTEhxWUdYQXBS?= =?eucgb2312_cn?b?K2xXZ01NYkxETWhmYzhMQkZhbmdKdnRJQk1xZ0Z1TE1ZNkYwRFpzMGpxYjBqVm9r?= =?eucgb2312_cn?b?NFBwanF5c1dIYW1jMjVWNFpkdVkzMysrcktodW9wTDR4ZS92b2VaMTZteGtQM093?= =?eucgb2312_cn?b?bkZkSVB1dHFva04zdkxQekE9PQ==?= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:zh-cn;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:TYUPR06MB6217.apcprd06.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(38070700018);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?eucgb2312_cn?b?b2dwV3ZWOWJibHFuU0kzeXN1?= =?eucgb2312_cn?b?QlRqVk9mVFJSRHl2NHpvQXNFY0Y3RjQvQnMzSG5FanEyTWpxMHJ0emlORkxMd1RQ?= =?eucgb2312_cn?b?aHBsSlRIZ3R4U1lxWVFLUExyT3BRR29nT2lxMGpWQXNpbm0yb0c5ZjREa0RIcXpt?= =?eucgb2312_cn?b?Q3ZnbldoQzBhRE11Wkd6aHBhZlkwbGdOR3p6NDJBK05ndUsyV3FiUFBJUlJvWWJI?= =?eucgb2312_cn?b?MFdTaEpMSDJPbWhldysvb212KytYendTaXpBNXUvMk1xTlM5QTFsZXlXcGtQYTFn?= =?eucgb2312_cn?b?aVFhSW0vZnE2ZWt1Z0czMThKVjNyVGlxMCthdloyc0thdkdjcDZ5QVRsSGFxSmZo?= =?eucgb2312_cn?b?aGZiNEM0S215U0QwaEMxR2lZNk5lemZIUk5tN2oyeUxNaVA5UEZqS2NDNFlFVW5I?= =?eucgb2312_cn?b?SSs3UFNrVXdjMWdxbzViMHpYeGlCZDZYbFlpaWlBZDAxaHg4S09wKzFlTWp1cDUy?= =?eucgb2312_cn?b?Ym1tVlFnSytIVUJnL3dWSjV1dktuV3FPbjJqTDM2ZThCY1pLYlBMMjQrMm9pU2da?= =?eucgb2312_cn?b?a3B6VEluaHJmMm5RSmZFL1JXdXVUSmZodHVmZkduSmpqWms3T0tCMkR1UWl6Y1ZI?= =?eucgb2312_cn?b?aTJXblF2NCtETmNwcUNEdnpaY09VcDhtNUhQbHp6cW5MdFdCdTNSb3BQK1F3SGcr?= =?eucgb2312_cn?b?a3doa1hnRjB2SmMzMGVmcENDYUwxV3AzL1FoL1htODB2MUQ2d2lyYjR4aHVxRWFO?= =?eucgb2312_cn?b?M041ZVl4aU1OOHdoSVZqZmhZa3FPYktCWmhKTUZqL0VOWjVRdlhqU3RBWkF1d1NL?= =?eucgb2312_cn?b?cG1qSjg4c21tQ3o4NVFuRkhyVmZiL2NuU3NHeEphU04wOFBONG9EOFRnS1FaNkNZ?= =?eucgb2312_cn?b?V1A4cHBwNmFoZWhDMSs1ZlJxMlA4blZCMkpCbVdhWlJIMFl5U2RXNnJOYndKaGhL?= =?eucgb2312_cn?b?UktHQzlNcTJzVnEya21IaXpLdFgrRVUyNm9jdTE5amNJQlNSbDNBeU9HcEFMaXJS?= =?eucgb2312_cn?b?cGptaityL3FUOTdFUU56Z3RxcUVVTS8zbCtTaDZjYmhXeGUxVzhFTTl2SFlOdlBD?= =?eucgb2312_cn?b?ZU9raElUUmNiYzdvTWdGSjBBZTBaT0hMS0JQczhIT3RRMHFoaWpoa0xaT294TG1K?= =?eucgb2312_cn?b?VjB4SHI4cG1JZHphck1JL0xJckpYajhxK2c4azhzWTcvK2FMcHRhK1piUk9Ya3ky?= =?eucgb2312_cn?b?UlRBZDhoK1JHMm5pa2thRzBjOUoxN0toT1NrdjNSaEdEdndVdHR1TVY3VlhndklQ?= =?eucgb2312_cn?b?b0pCKzJoUjdvbVJyZXhzY2hhdmlRNzhJS2FNcUZuMm9jaEtreG44azZtK0hiMHJB?= =?eucgb2312_cn?b?WU83TzFuTmozRldlM1R4cjVzRW5mdllkRmkyMEJZdUZVaVI3d3E0R3ZnaURBYkR5?= =?eucgb2312_cn?b?dHMzakJnTmk0TnQyQUxYbW5yYXA1U2dMaW8xMkRYTXQzSk9CdW5rV0I0U0l1NGY3?= =?eucgb2312_cn?b?Nyt0MkowM0F2Sk9zYVFUZ1A5aGZ3dXRoWFFhQmxzeEhaajlFVkNPSUpodEVyWWhN?= =?eucgb2312_cn?b?aHRVZ0ZITzBHQ2M3RUt4SVo5L0wybE5zOWhFTGoxOWUzVHJSVnAwd1I0MzUyZkN2?= =?eucgb2312_cn?b?TFlnOW5IdHpobnBpRkEvK3NSWnJkNGgwMGoxWDJHdlJON2VTTFhDYXFEYnYwc3Vu?= =?eucgb2312_cn?b?SkZNUWJoRktIS29WYVRQSzFreGtMUElyZ2Z2ejZWSk1BaTB2Rm1TQjhKdmVvUmEz?= =?eucgb2312_cn?b?QmNOeElaZHpMQXVHSXJOZnY4eEVpcmRMN1o2TEFjK2VxZnJwdFRhQ3JDSnRWenND?= =?eucgb2312_cn?b?bGxFbStDMnRHbmE4a1VUR0tnL3pUSmw5R2ROZm96T2pURHBtMW9hemhVa25jU2tC?= =?eucgb2312_cn?b?RXpzSWV6TnJOUGptV1kwMndGQ0xtbTRncEVjb2hwa2I2NmQ5UkxXUXgveGkxVXFW?= =?eucgb2312_cn?b?bDVVRjI5R2Z6am1MZjl0YWYxVDZQVklVZHRyQjBaS1B5UENYaGJ2Q2VlR3I5dmN4?= =?eucgb2312_cn?b?Y2NrNm84bCtqa3A3ZXE0RWFBVytxYkw3SnFhbUYrTnVCWGlVTFdjRzZHYXA4TWh4?= =?eucgb2312_cn?b?aTRRaWR4R0ZkV3BjZHIzWGxGZXNTZXJiUzhSRTFldzYyU1JOQlJnU2JIRnN5YjNn?= =?eucgb2312_cn?b?eDAxREdiSE9MSmZlVDBaRXdmcUV0cEJqST0=?= Precedence: bulk X-Mailing-List: linux-usb@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-OriginatorOrg: vivo.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: TYUPR06MB6217.apcprd06.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: a7148f79-bd64-4932-d27e-08dd13940205 X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Dec 2024 12:14:16.5886 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 923e42dc-48d5-4cbe-b582-1a797a6412ed X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 1TjzU6pE0gx2d5ynKvxNbmYobPubsXeMSy9lzcLCpfq7FRSsxxzy9VgzCG/LA5TysRXwrsXrrDJMObJtQIOfOg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: KL1PR06MB5882 From: Lianqin Hu Considering that in some extreme cases, when u_serial driver is accessed by multiple threads, Thread A is executing the open operation and calling the gs_open, Thread B is executing the disconnect operation and calling the gserial_disconnect function,The port->port_usb pointer will be set to NULL. E.g. Thread A Thread B gs_open() gadget_unbind_driver() gs_start_io() composite_disconnect() gs_start_rx() gserial_disconnect() ... ... spin_unlock(&port->port_lock) status = usb_ep_queue() spin_lock(&port->port_lock) spin_lock(&port->port_lock) port->port_usb = NULL gs_free_requests(port->port_usb->in) spin_unlock(&port->port_lock) Crash This causes thread A to access a null pointer (port->port_usb is null) when calling the gs_free_requests function, causing a crash. If port_usb is NULL, the release request will be skipped as it will be done by gserial_disconnect. So add a null pointer check to gs_start_io before attempting to access the value of the pointer port->port_usb. Call trace: gs_start_io+0x164/0x25c gs_open+0x108/0x13c tty_open+0x314/0x638 chrdev_open+0x1b8/0x258 do_dentry_open+0x2c4/0x700 vfs_open+0x2c/0x3c path_openat+0xa64/0xc60 do_filp_open+0xb8/0x164 do_sys_openat2+0x84/0xf0 __arm64_sys_openat+0x70/0x9c invoke_syscall+0x58/0x114 el0_svc_common+0x80/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x38/0x68 Fixes: c1dca562be8a ("usb gadget: split out serial core") Cc: stable@vger.kernel.org Suggested-by: Prashanth K Signed-off-by: Lianqin Hu Acked-by: Prashanth K v4: - Remove blank lines and some address information from patch descriptions - Added Fixes tag - CC stable kernel - Link to v3: https://lore.kernel.org/all/TYUPR06MB62170A30651D64EB59F94B88D22F2@TYUPR06MB6217.apcprd06.prod.outlook.com/ v3: - Update patch submission description - Link to v2: https://lore.kernel.org/all/TYUPR06MB62178D00DC96CC2702114CF5D2222@TYUPR06MB6217.apcprd06.prod.outlook.com/ v2: - Modify patch content and description according to "v1 suggestion" - Link to v1: https://lore.kernel.org/all/TYUPR06MB621737D16F68B5ABD6CF5772D2272@TYUPR06MB6217.apcprd06.prod.outlook.com/ drivers/usb/gadget/function/u_serial.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index 0a8c05b2746b..53d9fc41acc5 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -579,9 +579,12 @@ static int gs_start_io(struct gs_port *port) * we didn't in gs_start_tx() */ tty_wakeup(port->port.tty); } else { - gs_free_requests(ep, head, &port->read_allocated); - gs_free_requests(port->port_usb->in, &port->write_pool, - &port->write_allocated); + /* Free reqs only if we are still connected */ + if (port->port_usb) { + gs_free_requests(ep, head, &port->read_allocated); + gs_free_requests(port->port_usb->in, &port->write_pool, + &port->write_allocated); + } status = -EIO; }