usb: dwc3: Do not traverse list using list_for_each_safe
There is a possibility of race between endpoint transfer completion context and stop active transfer context. As a result dwc3_cleanup_done_reqs() iterates over started_list using list_for_each_safe while dwc3_remove_requests() is deleting req from started list. While iterating over current list node list_for_each_safe caches next list node. If the cached list node is getting deleted by dwc3_remove_requests() then request for same list node would be given back as part of endpoint transfer completion. This result into list_del corruption because list node is getting deleted twice. Fix this issue by iterating started_list using while loop and always accessing first node from list head. Change-Id: I64104a43ade015923deeb1f230a17dea08817052 Signed-off-by:Hemant Kumar <hemantk@codeaurora.org> Signed-off-by:
Ajay Agarwal <ajaya@codeaurora.org>
Loading
Please register or sign in to comment