Commit c6a57da2 authored Mar 06, 2019 by Jack Pham Committed by Ajay Agarwal May 29, 2019

usb: dwc3: gadget: Ensure no control transfers in progress when stopping



When dwc3_gadget_pullup() is called to perform a device-initiated
disconnect, the driver must ensure that no transfers are in progress
before clearing the run/stop bit.
However, in dwc3_gadget_pullup, before the dwc->lock is acquired,
a race is possible in which a new ep0 transfer gets started and we
receive another SETUP packet from the host before proceeding to take
the lock.

To fix this, simply don't allow a new ep0 transfer to start if
dwc->softconnect is false;.

Change-Id: Ie79c99bfa2b305ef44695d01b3f9395253aaf8f8
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>

parent 5bcb4a03

drivers/usb/dwc3/ep0.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -333,6 +333,9 @@ void dwc3_ep0_out_start(struct dwc3 *dwc)
		{
		int ret;

		if (!dwc->softconnect)
		return;

		dwc3_ep0_prepare_one_trb(dwc, 0, dwc->ctrl_req_addr, 8,
		DWC3_TRBCTL_CONTROL_SETUP, false);
		ret = dwc3_ep0_start_trans(dwc, 0);