Merge "usb: dwc3: gadget: Prevent double free scenario for cancelled_list" (9d6eaf90) · Commits · e / devices / android_kernel_fairphone_FP5

drivers/usb/dwc3/gadget.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -3427,10 +3427,13 @@ static void dwc3_endpoint_interrupt(struct dwc3 *dwc,
		dep->dbg_ep_events.epcmdcomplete++;
		cmd = DEPEVT_PARAMETER_CMD(event->parameters);

		if (cmd == DWC3_DEPCMD_ENDTRANSFER) {
		if (cmd == DWC3_DEPCMD_ENDTRANSFER &&
		(dep->flags & DWC3_EP_END_TRANSFER_PENDING)) {
		dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING;
		dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
		dwc3_gadget_ep_cleanup_cancelled_requests(dep);
		dbg_log_string("DWC3_DEPEVT_EPCMDCMPLT (%d)",
		dep->number);

		if (dep->flags & DWC3_EP_PENDING_CLEAR_STALL) {
		struct dwc3 *dwc = dep->dwc;