Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 33d289bc authored by Chandana Kishori Chiluveru's avatar Chandana Kishori Chiluveru Committed by Hemant Kumar
Browse files

usb: dwc3: Disable the irq before clearing run_stop bit



Consider a case of quick pull-up disable after pull-up is enabled.
If a SETUP packet comes after bus reset event followed by connection
done event, there is a possibility of race between
composite_dev_cleanup() freeing cdev->req called from
configfs_composite_unbind() and composite_setup() storing req pointer
to stack. This causes use after free of cdev->req. Fix this issue by
disabling the irq before clearing the run-stop bit so that interrupt
handling for setup packet is prevented. In order to prevent running
bottom half check pullups_connected flag in dwc3_interrupt and ack
the generated events and return. Also flush the bottom half work
if there was any work pending before disabling dwc3 irq.

Change-Id: I979da8536bd6766153e25cf6120f00f348427a72
Signed-off-by: default avatarChandana Kishori Chiluveru <cchiluve@codeaurora.org>
Signed-off-by: default avatarHemant Kumar <hemantk@codeaurora.org>
parent c6584024
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment