Commit f4cbcab1 authored May 04, 2016 by Chandana Kishori Chiluveru Committed by Gerrit - the friendly Code Review server Jan 05, 2021

usb: gadget: composite: Add spinlock protection for usb string descriptor

During composition switch, android driver stops data transfers first
and removes configuration before disabling the pullup. With this sequence
there is a possibility for a race where usb_remove_config is in progress
during which pullup is active and sending the setup request for strings
with zero configuration value. Hence fix the issue by adding spinlock
protection for get_sring descriptor.

Change-Id: I13c601f0e48d847b322a2761cd52268963cacf01
Signed-off-by: Chandana Kishori Chiluveru <cchiluve@codeaurora.org>

parent 7ff28e58

drivers/usb/gadget/composite.c

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -1815,8 +1815,10 @@ composite_setup(struct usb_gadget gadget, const struct usb_ctrlrequest ctrl)
	value = min(w_length, (u16) value);		value = min(w_length, (u16) value);
	break;		break;
	case USB_DT_STRING:		case USB_DT_STRING:
			spin_lock(&cdev->lock);
	value = get_string(cdev, req->buf,		value = get_string(cdev, req->buf,
	w_index, w_value & 0xff);		w_index, w_value & 0xff);
			spin_unlock(&cdev->lock);
	if (value >= 0)		if (value >= 0)
	value = min(w_length, (u16) value);		value = min(w_length, (u16) value);
	break;		break;