Commit 46b07177 authored Mar 06, 2019 by Jack Pham Committed by Gerrit - the friendly Code Review server Apr 03, 2019

usb: dwc3: gadget: Ensure no control transfers in progress when stopping



When dwc3_gadget_pullup() is called to perform a device-initiated
disconnect, the driver must ensure that no transfers are in progress
before clearing the run/stop bit. Currently there is a check which
ensures ep0 is in EP0_SETUP_PHASE and if not simply waits for any
pending control transfer to conclude and return to that initial state.
However, since this is done before the dwc->lock is acquired, this
allows for a race in which a new ep0 transfer gets started and we
receive another SETUP packet from the host before proceeding to take
the lock.

To fix this, simply don't allow a new ep0 transfer to start if
dwc->softconnect is false.

Change-Id: Ie79c99bfa2b305ef44695d01b3f9395253aaf8f8
Signed-off-by: Jack Pham <jackp@codeaurora.org>

parent 62ea0b2a

drivers/usb/dwc3/ep0.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -296,6 +296,9 @@ void dwc3_ep0_out_start(struct dwc3 *dwc)

		complete(&dwc->ep0_in_setup);

		if (!dwc->softconnect)
		return;

		dep = dwc->eps[0];
		dwc3_ep0_prepare_one_trb(dep, dwc->ep0_trb_addr, 8,
		DWC3_TRBCTL_CONTROL_SETUP, false);