[PATCH] usb: gadget: ether: Fix race between gether_disconnect and rx_submit

[Felipe Balbi]

From: Kiruthika Varadarajan <kiruthika.varadara...@harman.com>

On spin lock release in rx_submit, gether_disconnect get a chance to
run, it makes port_usb NULL, rx_submit access NULL port USB, hence null
pointer crash.

Fixed by releasing the lock in rx_submit after port_usb is used.

Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
Cc: <sta...@vger.kernel.org>
Signed-off-by: Kiruthika Varadarajan <kiruthika.varadara...@harman.com>
Signed-off-by: Felipe Balbi <felipe.ba...@linux.intel.com>
---
 drivers/usb/gadget/function/u_ether.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/u_ether.c 
b/drivers/usb/gadget/function/u_ether.c
index 737bd77a575d..2929bb47a618 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -186,11 +186,12 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, 
gfp_t gfp_flags)
                out = dev->port_usb->out_ep;
        else
                out = NULL;
-       spin_unlock_irqrestore(&dev->lock, flags);
 
        if (!out)
+       {
+               spin_unlock_irqrestore(&dev->lock, flags);
                return -ENOTCONN;
-
+       }
 
        /* Padding up to RX_EXTRA handles minor disagreements with host.
         * Normally we use the USB "terminate on short read" convention;
@@ -214,6 +215,7 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, 
gfp_t gfp_flags)
 
        if (dev->port_usb->is_fixed)
                size = max_t(size_t, size, dev->port_usb->fixed_out_len);
+       spin_unlock_irqrestore(&dev->lock, flags);
 
        skb = __netdev_alloc_skb(dev->net, size + NET_IP_ALIGN, gfp_flags);
        if (skb == NULL) {
-- 
2.22.0