Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9ef1fc4f authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "usb: gadget: f_mtp: Avoid race between mtp_read and mtp_function_disable"

parents 7f3b510e 10bc3e66

drivers/usb/gadget/function/f_mtp.c

+15 −0
Original line number Diff line number Diff line
@@ -613,7 +613,17 @@ static ssize_t mtp_read(struct file *fp, char __user *buf, 
		return -EINVAL;



	spin_lock_irq(&dev->lock);

	if (dev->state == STATE_OFFLINE) {

		spin_unlock_irq(&dev->lock);

		return -ENODEV;

	}



	if (dev->ep_out->desc) {

		if (!cdev) {

			spin_unlock_irq(&dev->lock);

			return -ENODEV;

		}



		len = usb_ep_align_maybe(cdev->gadget, dev->ep_out, count);

		if (len > MTP_BULK_BUFFER_SIZE) {

			spin_unlock_irq(&dev->lock);
@@ -1498,7 +1508,10 @@ mtp_function_unbind(struct usb_configuration *c, struct usb_function *f) 
	while ((req = mtp_req_get(dev, &dev->intr_idle)))

		mtp_request_free(req, dev->ep_intr);

	mutex_unlock(&dev->read_mutex);

	spin_lock_irq(&dev->lock);

	dev->state = STATE_OFFLINE;

	dev->cdev = NULL;

	spin_unlock_irq(&dev->lock);

	kfree(f->os_desc_table);

	f->os_desc_n = 0;

	fi_mtp->func_inst.f = NULL;
@@ -1554,7 +1567,9 @@ static void mtp_function_disable(struct usb_function *f) 
	struct usb_composite_dev	*cdev = dev->cdev;



	DBG(cdev, "mtp_function_disable\n");

	spin_lock_irq(&dev->lock);

	dev->state = STATE_OFFLINE;

	spin_unlock_irq(&dev->lock);

	usb_ep_disable(dev->ep_in);

	usb_ep_disable(dev->ep_out);

	usb_ep_disable(dev->ep_intr);