UPSTREAM: usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
commit e002e92e88e12457373ed096b18716d97e7bbb20 upstream.
Commit ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with
device_move") reparents the gadget device to /sys/devices/virtual during
unbind, clearing the gadget pointer. If the userspace tool queries on
the surviving interface during this detached window, this leads to a
NULL pointer dereference.
Unable to handle kernel NULL pointer dereference
Call trace:
eth_get_drvinfo+0x50/0x90
ethtool_get_drvinfo+0x5c/0x1f0
__dev_ethtool+0xaec/0x1fe0
dev_ethtool+0x134/0x2e0
dev_ioctl+0x338/0x560
Add a NULL check for dev->gadget in eth_get_drvinfo(). When detached,
skip copying the fw_version and bus_info strings, which is natively
handled by ethtool_get_drvinfo for empty strings.
Suggested-by: Val Packett <[email protected]>
Reported-by: Val Packett <[email protected]>
Closes: https://lore.kernel.org/linux-usb/[email protected]/
Fixes: ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with device_move")
Cc: stable <[email protected]>
Signed-off-by: Kuen-Han Tsai <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Bug: 522148273
(cherry picked from commit 0326429e8ba99892e1d1e115dc8e88e1a3b64e24)
Change-Id: I111664ae4b7eaf1c477d792bacf8e134aaba667f
Signed-off-by: Albert Wang <[email protected]>
Signed-off-by: Carlos Llamas <[email protected]>
1 file changed
