Commit f0a45129 authored Nov 13, 2017 by Mayank Rana

dwc3: gadget: Flush dwc_wq with dwc3_gadget_stop() API



composite_unbind() frees cdev, cdev->req and cdev->os_desc_req
which happens with USB composition switch. There is possibility
that USB enumeration is under progress (i.e. ep0 data transfer)
and USB compositon switch is peformed, then composite_setup()
may race against composite_unbind() and results into accessing
cdev->req and cdev->os_desc_req. Fix this issue by flushing
dwc_wq which makes sure that all received ep0 based events are
handled before cdev, cdev->req and cdev->os_desc_req are freed.

Change-Id: I7b1a4cbfcfd5b52b871e49445a160efb4c333b29
Signed-off-by: Mayank Rana <mrana@codeaurora.org>

parent 5bc0e57c

drivers/usb/dwc3/gadget.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -2333,6 +2333,10 @@ static int dwc3_gadget_stop(struct usb_gadget *g)
		dwc->gadget_driver = NULL;
		spin_unlock_irqrestore(&dwc->lock, flags);

		dbg_event(0xFF, "fwq_started", 0);
		flush_workqueue(dwc->dwc_wq);
		dbg_event(0xFF, "fwq_completed", 0);

		return 0;
		}