Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 73359cef authored by Felipe Balbi's avatar Felipe Balbi
Browse files

usb: dwc3: gadget: WARN() on bogus usb_ep_queue() 



Some gadget/function drivers might want to do
improper request recycling by allocating a single
request from one particular endpoint and queueing
it to another completely unrelated endpoint.

One such case was found with f_loopback.c.

To prevent such cases from happening again, let's
WARN() so we get a loud enough failure and persuade
users to report errors.

Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
parent 06a374ed

drivers/usb/dwc3/gadget.c

+10 −2
Original line number Diff line number Diff line
@@ -1140,8 +1140,14 @@ static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request, 
	if (!dep->endpoint.desc) {

		dev_dbg(dwc->dev, "trying to queue request %p to disabled %s\n",

				request, ep->name);

		spin_unlock_irqrestore(&dwc->lock, flags);

		return -ESHUTDOWN;

		ret = -ESHUTDOWN;

		goto out;

	}



	if (WARN(req->dep != dep, "request %p belongs to '%s'\n",

				request, req->dep->name)) {

		ret = -EINVAL;

		goto out;

	}



	dev_vdbg(dwc->dev, "queing request %p to %s length %d\n",
@@ -1149,6 +1155,8 @@ static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request, 
	trace_dwc3_ep_queue(req);



	ret = __dwc3_gadget_ep_queue(dep, req);



out:

	spin_unlock_irqrestore(&dwc->lock, flags);



	return ret;