Commit b7ed96c4 authored Mar 10, 2014 by Jack Pham

usb: dwc3: gadget: Protect against ep disabling during completion



In dwc3_cleanup_done_reqs(), a potential race condition
could arise when dwc3_gadget_giveback() temporarily
releases the main spinlock.  If during this window the
very endpoint being handled becomes disabled, it would
lead to a NULL pointer dereference in the code that
follows.  Guard against this by making sure the endpoint
is still enabled after returning from the giveback call.

CRs-fixed: 628972
Change-Id: Ifdb823fff12747f699217d871a5959c85b5340f7
Signed-off-by: Jack Pham <jackp@codeaurora.org>

parent 01f3b4c6

drivers/usb/dwc3/gadget.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -2193,6 +2193,13 @@ static int dwc3_cleanup_done_reqs(struct dwc3 dwc, struct dwc3_ep dep,
		}
		dwc3_gadget_giveback(dep, req, status);

		/* EP possibly disabled during giveback? */
		if (!(dep->flags & DWC3_EP_ENABLED)) {
		dev_dbg(dwc->dev, "%s disabled while handling ep event\n",
		dep->name);
		return 0;
		}

		if (ret)
		break;
		} while (1);