Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 58bc1fb0 authored by Udipto Goswami's avatar Udipto Goswami
Browse files

usb: gadget: Prevent endless_req being freed from disconnect_work 



Commit 05c1d8c ("usb: gadget: Prevent use after free in qdss connect
& close") provided a fix for preventing dwc3 driver from accessing
usb_request after dequeue. However, while doing usb disconnect &
connecting again due to endless_req being NULL the BAM2BAM
communication fails. So for the subsequent time the transfer fails.

Fix this by removing endless_req check from disconnect_work.

Change-Id: I8411cb2ae854fb9e2fa15ff89670035ff645289d
Signed-off-by: default avatarUdipto Goswami <ugoswami@codeaurora.org>
parent a553f436

drivers/usb/gadget/function/f_qdss.c

+0 −9
Original line number Diff line number Diff line
@@ -550,7 +550,6 @@ static void usb_qdss_disconnect_work(struct work_struct *work) 
{

	struct f_qdss *qdss;

	int status;

	unsigned long flags;



	qdss = container_of(work, struct f_qdss, disconnect_w);

	pr_debug("%s\n", __func__);
@@ -572,14 +571,6 @@ static void usb_qdss_disconnect_work(struct work_struct *work) 
		status = set_qdss_data_connection(qdss, 0);

		if (status)

			pr_err("qdss_disconnect error\n");



		spin_lock_irqsave(&qdss->lock, flags);

		if (qdss->endless_req) {

			usb_ep_free_request(qdss->port.data,

					qdss->endless_req);

			qdss->endless_req = NULL;

		}

		spin_unlock_irqrestore(&qdss->lock, flags);

	}



	/*