Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0f35545c authored by Mayank Rana's avatar Mayank Rana Committed by Jack Pham
Browse files

dwc3: gadget: Take copy of dwc->gadget_driver before releasing lock 



gadget_driver can become null if gadget_stop is called while any other
gadget callbacks are in progress. As gadget callbacks needs to release
spinlock before the callback, store the local copy of gadget_driver to
avoid the race with gadget_stop.

Change-Id: I7f0cbf9af3e3b286f2826647f08215f29f699de1
Signed-off-by: default avatarMayank Rana <mrana@codeaurora.org>
Signed-off-by: default avatarJack Pham <jackp@codeaurora.org>
parent c36156c7

drivers/usb/dwc3/gadget.c

+16 −4
Original line number Original line Diff line number Diff line
@@ -2899,43 +2899,55 @@ static void dwc3_endpoint_interrupt(struct dwc3 *dwc, 




static void dwc3_disconnect_gadget(struct dwc3 *dwc)

static void dwc3_disconnect_gadget(struct dwc3 *dwc)

{

{

	struct usb_gadget_driver *gadget_driver;



	if (dwc->gadget_driver && dwc->gadget_driver->disconnect) {

	if (dwc->gadget_driver && dwc->gadget_driver->disconnect) {

		gadget_driver = dwc->gadget_driver;

		spin_unlock(&dwc->lock);

		spin_unlock(&dwc->lock);

		dbg_event(0xFF, "DISCONNECT", 0);

		dbg_event(0xFF, "DISCONNECT", 0);

		dwc->gadget_driver->disconnect(&dwc->gadget);

		gadget_driver->disconnect(&dwc->gadget);

		spin_lock(&dwc->lock);

		spin_lock(&dwc->lock);

	}

	}

}

}





static void dwc3_suspend_gadget(struct dwc3 *dwc)

static void dwc3_suspend_gadget(struct dwc3 *dwc)

{

{

	struct usb_gadget_driver *gadget_driver;



	if (dwc->gadget_driver && dwc->gadget_driver->suspend) {

	if (dwc->gadget_driver && dwc->gadget_driver->suspend) {

		gadget_driver = dwc->gadget_driver;

		spin_unlock(&dwc->lock);

		spin_unlock(&dwc->lock);

		dbg_event(0xFF, "SUSPEND", 0);

		dbg_event(0xFF, "SUSPEND", 0);

		dwc->gadget_driver->suspend(&dwc->gadget);

		gadget_driver->suspend(&dwc->gadget);

		spin_lock(&dwc->lock);

		spin_lock(&dwc->lock);

	}

	}

}

}





static void dwc3_resume_gadget(struct dwc3 *dwc)

static void dwc3_resume_gadget(struct dwc3 *dwc)

{

{

	struct usb_gadget_driver *gadget_driver;



	if (dwc->gadget_driver && dwc->gadget_driver->resume) {

	if (dwc->gadget_driver && dwc->gadget_driver->resume) {

		gadget_driver = dwc->gadget_driver;

		spin_unlock(&dwc->lock);

		spin_unlock(&dwc->lock);

		dbg_event(0xFF, "RESUME", 0);

		dbg_event(0xFF, "RESUME", 0);

		dwc->gadget_driver->resume(&dwc->gadget);

		gadget_driver->resume(&dwc->gadget);

		spin_lock(&dwc->lock);

		spin_lock(&dwc->lock);

	}

	}

}

}





static void dwc3_reset_gadget(struct dwc3 *dwc)

static void dwc3_reset_gadget(struct dwc3 *dwc)

{

{

	struct usb_gadget_driver *gadget_driver;



	if (!dwc->gadget_driver)

	if (!dwc->gadget_driver)

		return;

		return;





	if (dwc->gadget.speed != USB_SPEED_UNKNOWN) {

	if (dwc->gadget.speed != USB_SPEED_UNKNOWN) {

		gadget_driver = dwc->gadget_driver;

		spin_unlock(&dwc->lock);

		spin_unlock(&dwc->lock);

		dbg_event(0xFF, "UDC RESET", 0);

		dbg_event(0xFF, "UDC RESET", 0);

		usb_gadget_udc_reset(&dwc->gadget, dwc->gadget_driver);

		usb_gadget_udc_reset(&dwc->gadget, gadget_driver);

		spin_lock(&dwc->lock);

		spin_lock(&dwc->lock);

	}

	}

}

}