dwc3: gadget: Don't queue USB request if pull up is getting disable
There is possible race as below: a. pull up disable vs ep_queue() API b. pull up disable vs kick transfer from completion context to queue next request pull up disable sends END transfer command to per endpoint, and give back started request and pending request back to function driver. dwc3_gadget_giveback() API does release spinlock which may allow ep_queue() or completion handling to queue next request. This results into TRB pending without invoking end transfer command, whereas request is being given back to function driver and being freed. Hence on setting next pull up enable, USB controller accesses previous stale TRB causing unmapped page fault. Fix this issue by checking pull up disable or not while handling ep_queue() or kicking any new transfer from other transfer completion context. Change-Id: I391aed05cbfe183cd3e2fe2f1aa335e4fd9ec37c Signed-off-by:Mayank Rana <mrana@codeaurora.org> Signed-off-by:
Ajay Agarwal <ajaya@codeaurora.org>
Loading
Please register or sign in to comment