usb: gadget: f_hid: fix: Prevent accessing released memory
authorKrzysztof Opasiak <kopasiak90@gmail.com>
Thu, 19 Jan 2017 17:55:28 +0000 (18:55 +0100)
committerFelipe Balbi <felipe.balbi@linux.intel.com>
Tue, 24 Jan 2017 09:04:17 +0000 (11:04 +0200)
commitaa65d11aa008f4de58a9cee7e121666d9d68505e
treecbda81f51579395d2b960c26fe66a605fdb6c407
parent20d2ca955bd09639c7b01db5761d157c297aea0a
usb: gadget: f_hid: fix: Prevent accessing released memory

When we unlock our spinlock to copy data to user we may get
disabled by USB host and free the whole list of completed out
requests including the one from which we are copying the data
to user memory.

To prevent from this let's remove our working element from
the list and place it back only if there is sth left when we
finish with it.

Fixes: 99c515005857 ("usb: gadget: hidg: register OUT INT endpoint for SET_REPORT")
Cc: stable@vger.kernel.org
Tested-by: David Lechner <david@lechnology.com>
Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
drivers/usb/gadget/function/f_hid.c