1 files changed, 12 insertions, 0 deletions

diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index ff244f42723f..9f4fd7e849a0 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -1957,8 +1957,20 @@ static int eth_start_xmit (struct sk_buff *skb, struct net_device *net)
         }
 
         spin_lock_irqsave(&dev->req_lock, flags);
+        /*
+         * this freelist can be empty if an interrupt triggered disconnect()
+         * and reconfigured the gadget (shutting down this queue) after the
+         * network stack decided to xmit but before we got the spinlock.
+         */
+        if (list_empty(&dev->tx_reqs)) {
+                spin_unlock_irqrestore(&dev->req_lock, flags);
+                return 1;
+        }
+
         req = container_of (dev->tx_reqs.next, struct usb_request, list);
         list_del (&req->list);
+
+        /* temporarily stop TX queue when the freelist empties */
         if (list_empty (&dev->tx_reqs))
                 netif_stop_queue (net);
         spin_unlock_irqrestore(&dev->req_lock, flags);