Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 964aeda7 authored by Jerome Brunet's avatar Jerome Brunet Committed by Krishna Kurapati
Browse files

usb: gadget: u_audio: fix race condition on endpoint stop 



[ Upstream commit 068fdad20454f815e61e6f6eb9f051a8b3120e88 ]

If the endpoint completion callback is call right after the ep_enabled flag
is cleared and before usb_ep_dequeue() is call, we could do a double free
on the request and the associated buffer.

Fix this by clearing ep_enabled after all the endpoint requests have been
dequeued.

Change-Id: I3c9a0d635bb26fb73e628710e178f4a2278bfde4
Fixes: 7de8681be2cd ("usb: gadget: u_audio: Free requests only after callback")
Cc: stable <stable@vger.kernel.org>
Reported-by: default avatarThinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: default avatarJerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20210827092927.366482-1-jbrunet@baylibre.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Git-commit: 6a600523
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git


Signed-off-by: default avatarKrishna Kurapati <quic_kriskura@quicinc.com>
parent 47c49627

drivers/usb/gadget/function/u_audio.c

+2 −3
Original line number Diff line number Diff line
@@ -349,8 +349,6 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) 
	if (!prm->ep_enabled)

		return;



	prm->ep_enabled = false;



	audio_dev = uac->audio_dev;

	params = &audio_dev->params;
@@ -368,11 +366,12 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) 
		}

	}



	prm->ep_enabled = false;



	if (usb_ep_disable(ep))

		dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__);

}





int u_audio_start_capture(struct g_audio *audio_dev)

{

	struct snd_uac_chip *uac = audio_dev->uac;