Commit 71fc5f91 authored by Troy Kisky's avatar Troy Kisky Committed by Marek Vasut
Browse files

usb: gadget: ether: return error from rx_submit if no request

This prevents a crash if tftpboot is given a bad filename.

rx_req will be released by eth_reset_config
which is called by eth_disconnect,
which is called using the .disconnect member of usb_gadget_driver by mv_pullup in mv_udc
which is called using the .pullup member of usb_gadget_ops by usb_gadget_disconnect
which is called by usb_eth_halt
which is called using the .halt member of eth_device by eth_halt
which is called by TftpHandler when TFTP_ERR_FILE_NOT_FOUND or TFTP_ERR_ACCESS_DENIED occurs

I trigger this with the following commands
setenv ipaddr && setenv netmask && setenv serverip
setenv usbnet_devaddr 00:11:22:33:44:55 && setenv usbnet_hostaddr 00:aa:bb:cc:dd:ee
setenv ethprime usb_ether && setenv ethact usb_ether && setenv ncip
tftpboot 10800000
Signed-off-by: default avatarTroy Kisky <>
parent 43880ce5
......@@ -1536,6 +1536,8 @@ static int rx_submit(struct eth_dev *dev, struct usb_request *req,
debug("%s\n", __func__);
if (!req)
return -EINVAL;
size = (ETHER_HDR_SIZE + dev->mtu + RX_EXTRA);
size += dev->out_ep->maxpacket - 1;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment