f_mtp:Fix ptp kernel panic in factory mode

cdev could be null in the switching
PTP case, check the state before reading
To fix the panic issue

Change-Id: I30471023a72457854140ae867ed3977fba834dc0
Signed-off-by: a17671 <a17671@motorola.com>
Reviewed-on: https://gerrit.mot.com/1303922
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Xiangpo Zhao <zhaoxp3@motorola.com>
Submit-Approved: Jira Key

diff --git a/drivers/usb/gadget/function/f_mtp.c b/drivers/usb/gadget/function/f_mtp.c
index 302f073370e1c0bc29f4b47974ab03635b737013..01e6153c54d39ace52e3b4740082bef780b08455 100644 (file)
--- a/drivers/usb/gadget/function/f_mtp.c
+++ b/drivers/usb/gadget/function/f_mtp.c
@@ -580,7 +580,17 @@ static ssize_t mtp_read(struct file *fp, char __user *buf,
                goto done;\r
        }\r
        spin_lock_irq(&dev->lock);\r
+       if (dev->state == STATE_OFFLINE) {\r
+               spin_unlock_irq(&dev->lock);\r
+               return -ENODEV;\r
+       }\r
+\r
        if (dev->ep_out->desc) {\r
+               if (!cdev) {\r
+                       spin_unlock_irq(&dev->lock);\r
+                       return -ENODEV;\r
+               }\r
+\r
                len = usb_ep_align_maybe(cdev->gadget, dev->ep_out, count);\r
                if (len > MTP_BULK_BUFFER_SIZE) {\r
                        spin_unlock_irq(&dev->lock);\r