Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cff5638e authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Felipe Balbi
Browse files

usb: gadget: bdc_udc: fix race condition in bdc_udc_exit() 



bdc_ep_disable() expects to be called with bdc->lock held.
The assumption is met in all the cases except for call from bdc_udc_exit(),
that is called from bdc_remove(). As a result a race can happen or unheld
bdc->lock can be unlocked in bdc_req_complete().

The patch proposes to acquire-release bdc->lock around bdc_ep_disable()
in bdc_udc_exit().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
parent ead22caf

drivers/usb/gadget/udc/bdc/bdc_udc.c

+5 −0
Original line number Diff line number Diff line
@@ -581,8 +581,13 @@ int bdc_udc_init(struct bdc *bdc) 


void bdc_udc_exit(struct bdc *bdc)

{

	unsigned long flags;



	dev_dbg(bdc->dev, "%s()\n", __func__);

	spin_lock_irqsave(&bdc->lock, flags);

	bdc_ep_disable(bdc->bdc_ep_array[1]);

	spin_unlock_irqrestore(&bdc->lock, flags);



	usb_del_gadget_udc(&bdc->gadget);

	bdc_free_ep(bdc);

}