Merge "usb: dwc3: gadget: Prevent double free scenario for cancelled_list" (501bee3f) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/usb/dwc3/gadget.c

+18 −7

Original line number	Diff line number	Diff line
		@@ -1814,11 +1814,19 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
		*/
		list_for_each_entry_safe(r, t, &dep->started_list, list)
		dwc3_gadget_move_cancelled_request(r);
		/* If GEN1 controller then cleanup the cancelled
		* requests from here as check for
		* DWC3_EP_END_TRANSFER_PENDING in EPCMDCMPLT
		* will prevent the request on cancelled list from
		* getting cleared there.
		*/
		if (!(dep->flags & DWC3_EP_END_TRANSFER_PENDING)) {
		dbg_log_string("%s:giveback all request\n",
		__func__);
		dwc3_gadget_ep_cleanup_cancelled_requests(dep);
		}

		if (dep->flags & DWC3_EP_TRANSFER_STARTED)
		goto out0;
		else
		goto out1;
		}
		dev_err_ratelimited(dwc->dev, "request %pK was not queued to %s\n",
		request, ep->name);
		@@ -1826,7 +1834,6 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
		goto out0;
		}

		out1:
		dbg_ep_dequeue(dep->number, req);
		dwc3_gadget_giveback(dep, req, -ECONNRESET);

		@@ -3248,8 +3255,12 @@ static void dwc3_endpoint_interrupt(struct dwc3 *dwc,
		case DWC3_DEPEVT_EPCMDCMPLT:
		dep->dbg_ep_events.epcmdcomplete++;
		cmd = DEPEVT_PARAMETER_CMD(event->parameters);

		if (cmd == DWC3_DEPCMD_ENDTRANSFER) {
		/* Prevent GEN1 controllers to cleanup cancelled
		* request twice (one from error path in kick_transfer
		* another from here).
		*/
		if (cmd == DWC3_DEPCMD_ENDTRANSFER &&
		(dep->flags & DWC3_EP_END_TRANSFER_PENDING)) {
		dep->flags &= ~(DWC3_EP_END_TRANSFER_PENDING \|
		DWC3_EP_TRANSFER_STARTED);
		dwc3_gadget_ep_cleanup_cancelled_requests(dep);