[PATCH] USB/Gadget: Fix race between gether_disconnect and rx_submit

[kvaradarajan]

  On spin lock release in rx_submit, gether_disconnect get
  a chance to run, it makes port_usb NULL, rx_submit access
  NULL port USB, hence null pointer crash.

  Fixed by releasing the lock in rx_submit after port_usb
  is used.

Signed-off-by: KVaradarajan <kiruthika.varadara...@harman.com>
---
 drivers/usb/gadget/function/u_ether.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/function/u_ether.c 
b/drivers/usb/gadget/function/u_ether.c
index 737bd77..76cf1e4 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -186,11 +186,11 @@ static void defer_kevent(struct eth_dev *dev, int flag)
                out = dev->port_usb->out_ep;
        else
                out = NULL;
-       spin_unlock_irqrestore(&dev->lock, flags);
 
-       if (!out)
+       if (!out) {
+               spin_unlock_irqrestore(&dev->lock, flags);
                return -ENOTCONN;
-
+       }
 
        /* Padding up to RX_EXTRA handles minor disagreements with host.
         * Normally we use the USB "terminate on short read" convention;
@@ -215,6 +215,7 @@ static void defer_kevent(struct eth_dev *dev, int flag)
        if (dev->port_usb->is_fixed)
                size = max_t(size_t, size, dev->port_usb->fixed_out_len);
 
+       spin_unlock_irqrestore(&dev->lock, flags);
        skb = __netdev_alloc_skb(dev->net, size + NET_IP_ALIGN, gfp_flags);
        if (skb == NULL) {
                DBG(dev, "no rx skb\n");
-- 
1.9.1