]> git.baikalelectronics.ru Git - kernel.git/commit
usb: dwc2: host: fix use of qtd after free in desc dma mode
authorGregory Herrero <gregory.herrero@intel.com>
Thu, 5 Nov 2015 08:41:40 +0000 (09:41 +0100)
committerFelipe Balbi <balbi@ti.com>
Tue, 15 Dec 2015 15:12:41 +0000 (09:12 -0600)
commitf2d7390f6c93c7b56da2c214465cd2c6596e7524
treeb5e20b195b70baf3e974bde3dc3e54238ac5eeb5
parenta2f8550a214c9650a0e660fd3b13d3d437cb4a64
usb: dwc2: host: fix use of qtd after free in desc dma mode

When completing non isoc xfer, dwc2_complete_non_isoc_xfer_ddma()
is relying on qtd->n_desc to process the corresponding number of
descriptors.

During the processing of these descriptors, qtd could be unlinked
and freed if xfer is done and urb is no more in progress.

In this case, dwc2_complete_non_isoc_xfer_ddma() will read again
qtd->n_desc whereas qtd has been freed. This will lead to unpredictable
results since qtd->n_desc is no more valid value.

To avoid this error, return a result != 0 in dwc2_process_non_isoc_desc(),
so that dwc2_complete_non_isoc_xfer_ddma() stops desc processing.

This has been seen with Slub debug enabled.

Acked-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Gregory Herrero <gregory.herrero@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
drivers/usb/dwc2/hcd_ddma.c