]> git.baikalelectronics.ru Git - kernel.git/commit
usb: dwc3: gadget: Prevent EP queuing while stopping transfers
authorWesley Cheng <wcheng@codeaurora.org>
Thu, 11 Mar 2021 23:59:02 +0000 (15:59 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 17 Mar 2021 20:45:20 +0000 (21:45 +0100)
commit8b35804292f2fd14447f130da5a9a0db69423639
treebabce44fe418f05b2d1d3d1398f9bd2c01e391bf
parent7a55b07f80507817878d9e67cd794d64dd907ef7
usb: dwc3: gadget: Prevent EP queuing while stopping transfers

In the situations where the DWC3 gadget stops active transfers, once
calling the dwc3_gadget_giveback(), there is a chance where a function
driver can queue a new USB request in between the time where the dwc3
lock has been released and re-aquired.  This occurs after we've already
issued an ENDXFER command.  When the stop active transfers continues
to remove USB requests from all dep lists, the newly added request will
also be removed, while controller still has an active TRB for it.
This can lead to the controller accessing an unmapped memory address.

Fix this by ensuring parameters to prevent EP queuing are set before
calling the stop active transfers API.

Fixes: 970067e997e3 ("usb: dwc3: Stop active transfers before halting the controller")
Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
Link: https://lore.kernel.org/r/1615507142-23097-1-git-send-email-wcheng@codeaurora.org
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/dwc3/gadget.c