usb: gadget: f_ncm: fix double-free in ncm_unbind()

Author: maade93791

drivers/usb/gadget/function/f_ncm.c

@@ -1670,18 +1670,24 @@ static void ncm_unbind(struct usb_configuration *c, struct usb_function *f)
 	hrtimer_cancel(&ncm->task_timer);
 
 	kfree(f->os_desc_table);
+	f->os_desc_table = NULL;
 	f->os_desc_n = 0;
 
 	ncm_string_defs[0].id = 0;
 	usb_free_all_descriptors(f);
 
 	if (atomic_read(&ncm->notify_count)) {
-		usb_ep_dequeue(ncm->notify, ncm->notify_req);
+		if (ncm->notify_req)
+			usb_ep_dequeue(ncm->notify, ncm->notify_req);
 		atomic_set(&ncm->notify_count, 0);
 	}
 
-	kfree(ncm->notify_req->buf);
-	usb_ep_free_request(ncm->notify, ncm->notify_req);
+	if (ncm->notify_req) {
+		kfree(ncm->notify_req->buf);
+		ncm->notify_req->buf = NULL;
+		usb_ep_free_request(ncm->notify, ncm->notify_req);
+		ncm->notify_req = NULL;
+	}
 
 	ncm_opts->bind_count--;
 	if (ncm_opts->bind_count == 0)