From patchwork Thu Jul 1 11:48:30 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Maciej_=C5=BBenczykowski?= X-Patchwork-Id: 469394 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 29E85C11F67 for ; Thu, 1 Jul 2021 11:48:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0084E6128A for ; Thu, 1 Jul 2021 11:48:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236230AbhGALvV (ORCPT ); Thu, 1 Jul 2021 07:51:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53972 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236156AbhGALvU (ORCPT ); Thu, 1 Jul 2021 07:51:20 -0400 Received: from mail-pl1-x62b.google.com (mail-pl1-x62b.google.com [IPv6:2607:f8b0:4864:20::62b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A986AC0617A8 for ; Thu, 1 Jul 2021 04:48:50 -0700 (PDT) Received: by mail-pl1-x62b.google.com with SMTP id f11so3533536plg.0 for ; Thu, 01 Jul 2021 04:48:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=pQaNAfrD1+BiW8zjIC842Kwk61cOaCg4oH+q5bN0dno=; b=AhKo+tPrQzbO5ZwQpxfuq2JRA0a6XmLx8EI9jGOn6GcR2mz6kHKFzyRJ/CbRmNULU5 ETuhC3MHbyWTAPhssObKl1KibF+nq3qvWhg+QwbVdfRgDg6TX6St8Y22E7kVwA6Q3QXh Dl9fDTKBTG9JMVuWer+4IEA2yAxerqye9O8RkomdKRUOGA6S2VTAcosSCXPc4RgywWtg ggeyzOsohJbC1diawlqDH0z5M7vSxYLmoSQpFfX7QZ+6hFinGitIvAQl+50SwJMlkTMp hcwn5WiVbZ7ekIEM/gYSfNrtd360P5xgnoYd9i/ONrLZYd6LSQifDt5pt/jCthEKm+lM vjAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=pQaNAfrD1+BiW8zjIC842Kwk61cOaCg4oH+q5bN0dno=; b=tMK91YCrq9TxSXvTKZ9yzRuoT7PzvaBkwpZ/WK0t7HSzCxRouF36/3TLnt3JMw98pJ 7ZuFwbQlerfv81y2+wKZYXTIQ9Qazkv0LO1LgffjroHBRybBEc+5BAFuNw4ur9Vkzcr6 tXnEPsMu5bUu3N/eGqUq2aGofzaooHDJdbyF9urIJ7OYOXfQJng83eTrB3wq0AKAuio1 y6UwRc+/RJmgRm6r4mGCxCRS4agUM8S5QQM1UNLrJNPfUlailJvdGMclvPUO94tsFh2n mV5DDQUZ8ZImu85tHo9tz2lBw7kLTs3j4rJx+E2ByvCR87g9S5/bdGw3QaSsvpNv0HLK r00w== X-Gm-Message-State: AOAM530hk2b02zx6l4wfSNUbgFNObZ3Gh3OPaCzunZrch7UwSmXWxNJM QVmppH7YiA4rdEquQct8KHE= X-Google-Smtp-Source: ABdhPJwR/Ed3ulbMBjEHlZ/e1CVx25d7AwueHWrL3/Ak9g2emxmtZ+0Q/fA94thv1uFAZYxFnGxzoQ== X-Received: by 2002:a17:90a:ac06:: with SMTP id o6mr19046840pjq.124.1625140130208; Thu, 01 Jul 2021 04:48:50 -0700 (PDT) Received: from athina.mtv.corp.google.com ([2620:15c:211:200:6c1:7d8f:dfdc:fc1e]) by smtp.gmail.com with ESMTPSA id w2sm24600601pjq.5.2021.07.01.04.48.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 01 Jul 2021 04:48:49 -0700 (PDT) From: =?utf-8?q?Maciej_=C5=BBenczykowski?= To: =?utf-8?q?Maciej_=C5=BBenczykowski?= Cc: Linux USB Mailing List , Brooke Basile , "Bryan O'Donoghue" , Felipe Balbi , Greg Kroah-Hartman , Lorenzo Colitti Subject: [PATCH 2/6] usb: gadget: f_ncm: remove spurious boolean timer_stopping Date: Thu, 1 Jul 2021 04:48:30 -0700 Message-Id: <20210701114834.884597-2-zenczykowski@gmail.com> X-Mailer: git-send-email 2.32.0.93.g670b81a890-goog In-Reply-To: <20210701114834.884597-1-zenczykowski@gmail.com> References: <20210701114834.884597-1-zenczykowski@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org From: Maciej Żenczykowski It is equivalent to ncm->netdev being NULL. Cc: Brooke Basile Cc: "Bryan O'Donoghue" Cc: Felipe Balbi Cc: Greg Kroah-Hartman Cc: Lorenzo Colitti Signed-off-by: Maciej Żenczykowski --- drivers/usb/gadget/function/f_ncm.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c index afbe70bc8d6b..e45a938424a4 100644 --- a/drivers/usb/gadget/function/f_ncm.c +++ b/drivers/usb/gadget/function/f_ncm.c @@ -73,7 +73,6 @@ struct f_ncm { struct sk_buff *skb_tx_ndp; u16 ndp_dgram_count; struct hrtimer task_timer; - bool timer_stopping; }; static inline struct f_ncm *func_to_ncm(struct usb_function *f) @@ -889,7 +888,6 @@ static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt) if (ncm->port.in_ep->enabled) { DBG(cdev, "reset ncm\n"); - ncm->timer_stopping = true; ncm->netdev = NULL; gether_disconnect(&ncm->port); ncm_reset_values(ncm); @@ -927,7 +925,6 @@ static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt) if (IS_ERR(net)) return PTR_ERR(net); ncm->netdev = net; - ncm->timer_stopping = false; } spin_lock(&ncm->lock); @@ -1157,16 +1154,19 @@ static struct sk_buff *ncm_wrap_ntb(struct gether *port, static enum hrtimer_restart ncm_tx_timeout(struct hrtimer *data) { struct f_ncm *ncm = container_of(data, struct f_ncm, task_timer); + struct net_device *netdev = READ_ONCE(ncm->netdev); /* Only send if data is available. */ - if (!ncm->timer_stopping && ncm->skb_tx_data) { + if (netdev && ncm->skb_tx_data) { /* XXX This allowance of a NULL skb argument to ndo_start_xmit * XXX is not sane. The gadget layer should be redesigned so * XXX that the dev->wrap() invocations to build SKBs is transparent * XXX and performed in some way outside of the ndo_start_xmit * XXX interface. + * + * This will call directly into u_ether's eth_start_xmit() */ - ncm->netdev->netdev_ops->ndo_start_xmit(NULL, ncm->netdev); + netdev->netdev_ops->ndo_start_xmit(NULL, netdev); } return HRTIMER_NORESTART; } @@ -1355,7 +1355,6 @@ static void ncm_disable(struct usb_function *f) DBG(cdev, "ncm deactivated\n"); if (ncm->port.in_ep->enabled) { - ncm->timer_stopping = true; ncm->netdev = NULL; gether_disconnect(&ncm->port); } From patchwork Thu Jul 1 11:48:32 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Maciej_=C5=BBenczykowski?= X-Patchwork-Id: 469393 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 741F0C11F64 for ; Thu, 1 Jul 2021 11:48:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 52E7C61418 for ; Thu, 1 Jul 2021 11:48:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236274AbhGALvX (ORCPT ); Thu, 1 Jul 2021 07:51:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53988 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236156AbhGALvX (ORCPT ); Thu, 1 Jul 2021 07:51:23 -0400 Received: from mail-pj1-x102b.google.com (mail-pj1-x102b.google.com [IPv6:2607:f8b0:4864:20::102b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 70F0DC061756 for ; Thu, 1 Jul 2021 04:48:53 -0700 (PDT) Received: by mail-pj1-x102b.google.com with SMTP id 22-20020a17090a0c16b0290164a5354ad0so6781588pjs.2 for ; Thu, 01 Jul 2021 04:48:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=uV014lyWot4q3dxJvgp7qp4hRNRtbOV39xG3WiDgjAA=; b=boitMiY6+yRilBgegCnp0jclEgFE/fEhk7DTEia3CbqWPILmlpFPou4y5fdncqJllr ZWRLvlReyDCGPgpjDervSm7lg7ZRxwGs3jZWO/yDaNR+Oa5+prXMjgsmlkQyJI4pDh2B t9ck43tZXS1NZdrQss73iJeBs8zSZxnlbZHZ2FH0FZIPBp9bnieUK/86Gp6sWFBfep3X cEWCa+stFwOVw91bLuBVFTLlp3+jReFbGgMfAXmlQtabuAEtrxP+J2PviRmhqzlqI/sB p5QD+d86e+ZolsZMlKrvB96EWZyn4oK+DO2+i0X6S4Vkd3ov5/DsybmyT0C365FpQFUc S/PA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=uV014lyWot4q3dxJvgp7qp4hRNRtbOV39xG3WiDgjAA=; b=nFO4ZYqDPdRT3wuLUWBgEsjhNqc8vJAG0sSzOsqhNyxzloabMpGMwt5WwBt+W3YbZU q/0E4CxHzSbPExDyUv+eC187RyE6FgJImf8+HXLHeYUbHwQ2q7rG90osfjrSEeyXo8TR OA018hQXu8Y2GLLYAwnhCokJ5vTihz1z/ym6G4H5BeBsZ9tgfYiDfxZ+6u+mLPFX9w6b itscvsT3kQKe4a3327PIjbLLvrkbP11LLyInIuFhV6MqZqEBmQ7+sKFK8Adx0s80lBuh sxN38y3/Seup44z5et+FexMJCbS4ntqBpws+xERYvE8eePbK67lUJSIR/RvSAeDUy0i9 /y7w== X-Gm-Message-State: AOAM531cGNOK6Ib/4l3dkxQYBtuL0+yvYpqBUumql8ieu7knmi/LdRQx 7KLArJTT8BQ1EK83xc0Pano= X-Google-Smtp-Source: ABdhPJyPyhEiQrlqPqDi+zfmDaBnrTqlpF71Idbpr5PYH4+729aEXYo0FQaTtxXQerQW6iwPuYHibw== X-Received: by 2002:a17:90a:e7d1:: with SMTP id kb17mr9357563pjb.95.1625140133050; Thu, 01 Jul 2021 04:48:53 -0700 (PDT) Received: from athina.mtv.corp.google.com ([2620:15c:211:200:6c1:7d8f:dfdc:fc1e]) by smtp.gmail.com with ESMTPSA id w2sm24600601pjq.5.2021.07.01.04.48.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 01 Jul 2021 04:48:52 -0700 (PDT) From: =?utf-8?q?Maciej_=C5=BBenczykowski?= To: =?utf-8?q?Maciej_=C5=BBenczykowski?= Cc: Linux USB Mailing List , Brooke Basile , "Bryan O'Donoghue" , Felipe Balbi , Greg Kroah-Hartman , Lorenzo Colitti Subject: [PATCH 4/6] usb: gadget: f_ncm: remove spurious if statement Date: Thu, 1 Jul 2021 04:48:32 -0700 Message-Id: <20210701114834.884597-4-zenczykowski@gmail.com> X-Mailer: git-send-email 2.32.0.93.g670b81a890-goog In-Reply-To: <20210701114834.884597-1-zenczykowski@gmail.com> References: <20210701114834.884597-1-zenczykowski@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org From: Maciej Żenczykowski the current logic is: struct sk_buff *skb2 = NULL; ... if (!skb && !ncm->skb_tx_data) return NULL; if (skb) { ... } else if (ncm->skb_tx_data) ... } return skb2; Which means that first if statement is simply not needed. Cc: Brooke Basile Cc: "Bryan O'Donoghue" Cc: Felipe Balbi Cc: Greg Kroah-Hartman Cc: Lorenzo Colitti Signed-off-by: Maciej Żenczykowski --- drivers/usb/gadget/function/f_ncm.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c index 77f55b3c805a..cab17ae4fa34 100644 --- a/drivers/usb/gadget/function/f_ncm.c +++ b/drivers/usb/gadget/function/f_ncm.c @@ -1025,9 +1025,6 @@ static struct sk_buff *ncm_wrap_ntb(struct gether *port, const int rem = le16_to_cpu(ntb_parameters.wNdpInPayloadRemainder); const int dgram_idx_len = 2 * 2 * opts->dgram_item_len; - if (!skb && !ncm->skb_tx_data) - return NULL; - if (skb) { /* Add the CRC if required up front */ if (ncm->is_crc) { From patchwork Thu Jul 1 11:48:34 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Maciej_=C5=BBenczykowski?= X-Patchwork-Id: 469392 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6983CC11F64 for ; Thu, 1 Jul 2021 11:48:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4EDCA61481 for ; Thu, 1 Jul 2021 11:48:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236291AbhGALv0 (ORCPT ); Thu, 1 Jul 2021 07:51:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54002 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236287AbhGALv0 (ORCPT ); Thu, 1 Jul 2021 07:51:26 -0400 Received: from mail-pj1-x102f.google.com (mail-pj1-x102f.google.com [IPv6:2607:f8b0:4864:20::102f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 540D4C061756 for ; Thu, 1 Jul 2021 04:48:56 -0700 (PDT) Received: by mail-pj1-x102f.google.com with SMTP id g24so4074678pji.4 for ; Thu, 01 Jul 2021 04:48:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=40hk2UKCucED2JvsthYv/hJYjyDf5D1LuQwzsb/vpGM=; b=KYCsnlyv7f6188gFGR2vyzcJ9civF4+0g6sv90xIgHzyzZkusKH4UUVs326FYgxmOi lf/faXDbuJtZS5jSoJ9tC3py3xc+FN9mDoDClaCnLKDjZQq2viZkto9u8VYK2uQ216K+ u5cWCUgoA+/3lHh0F7d8qXnog03ZA3Oq8HBPaPIHl+/QDE++7/AkqVPagc/EbxXKTggt xA9eppj0yP/lxs/9kDQmPBkEMhOg++IIZ262T1SfK6nuHx/DDQVTwRdCamrHCzu70v/P 1AlKB7H4MQVXMck08dhgQhGtVwYnIRCqEzTez8yKHmyHRpiGJmFq14zF3LPvQDlEk0lL 5PxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=40hk2UKCucED2JvsthYv/hJYjyDf5D1LuQwzsb/vpGM=; b=SiZjxcmpAAUQxiSFTed3CKFBWlTOH/69RIHcqzSh0UYR0EtjcmLPJWBVJ+wX//btpa zKn7ISJdcNfbcQ01ZCP4XuWgzmGyj/87cYK90+dXWKQIBPbIozIfQKENvG94FbrfoHiq aAaMVSIp8fwLFZdgLYaLj4OiTgm8FkamKrTpJcuRBRNUNaBknGPC0FBRr1iL2Ei8+fup bveAO1Q/doos+aa8yAvC+7U2xjdAQBTkYJ90MBj6UB0L6aB5d7E3BJS+aJ+QysfCMVsS g+GT/Il/1aDEXLvROwm7iTW/KQkT5vjiIuyKnw4Uv4xgFpBYdZcsQGhKHRbML9zF1wjS ih4A== X-Gm-Message-State: AOAM5322gBokgXuWv43PoHpObhQahrQVblsvgbanl5CenbDzIhG56f6S Y3sl76AvMRViamIEuqoucyw= X-Google-Smtp-Source: ABdhPJwFGuOpahXmkzNYOXHFx7Sw5C6xRn24GJaqPyxT0Xrn13Cki8ohhrQRn56UdNdNeYitwvrxVw== X-Received: by 2002:a17:90a:be0e:: with SMTP id a14mr9516217pjs.43.1625140135889; Thu, 01 Jul 2021 04:48:55 -0700 (PDT) Received: from athina.mtv.corp.google.com ([2620:15c:211:200:6c1:7d8f:dfdc:fc1e]) by smtp.gmail.com with ESMTPSA id w2sm24600601pjq.5.2021.07.01.04.48.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 01 Jul 2021 04:48:55 -0700 (PDT) From: =?utf-8?q?Maciej_=C5=BBenczykowski?= To: =?utf-8?q?Maciej_=C5=BBenczykowski?= Cc: Linux USB Mailing List , Brooke Basile , "Bryan O'Donoghue" , Felipe Balbi , Greg Kroah-Hartman , Lorenzo Colitti Subject: [PATCH 6/6] usb: gadget: u_ether: fix a potential null pointer dereference Date: Thu, 1 Jul 2021 04:48:34 -0700 Message-Id: <20210701114834.884597-6-zenczykowski@gmail.com> X-Mailer: git-send-email 2.32.0.93.g670b81a890-goog In-Reply-To: <20210701114834.884597-1-zenczykowski@gmail.com> References: <20210701114834.884597-1-zenczykowski@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org From: Maciej Żenczykowski f_ncm tx timeout can call us with null skb to flush a pending frame. In this case skb is NULL to begin with but ceases to be null after dev->wrap() completes. In such a case in->maxpacket will be read, even though we've failed to check that 'in' is not NULL. Though I've never observed this fail in practice, however the 'flush operation' simply does not make sense with a null usb IN endpoint - there's nowhere to flush to... (note that we're the gadget/device, and IN is from the point of view of the host, so here IN actually means outbound...) Cc: Brooke Basile Cc: "Bryan O'Donoghue" Cc: Felipe Balbi Cc: Greg Kroah-Hartman Cc: Lorenzo Colitti Signed-off-by: Maciej Żenczykowski --- drivers/usb/gadget/function/u_ether.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c index d1d044d9f859..85a3f6d4b5af 100644 --- a/drivers/usb/gadget/function/u_ether.c +++ b/drivers/usb/gadget/function/u_ether.c @@ -492,8 +492,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, } spin_unlock_irqrestore(&dev->lock, flags); - if (skb && !in) { - dev_kfree_skb_any(skb); + if (!in) { + if (skb) + dev_kfree_skb_any(skb); return NETDEV_TX_OK; }