Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d4d45536 authored by Vijayavardhan Vennapusa's avatar Vijayavardhan Vennapusa Committed by Gerrit - the friendly Code Review server
Browse files

usb: gadget: composite: Add spinlock protection for usb config descriptor 



During composition switch, android driver stops data transfers first and
removes configuration before disabling pullup for USB3 controller. With
this sequence there is a possibility for a race where usb_remove_config is
in progress during which pullup is active and sending the setup request for
configuration descriptor with zero configuration value. Hence fix the issue
by adding spinlock protection for get_config descriptor.

CRs-Fixed: 1052608
Change-Id: I65d38387f77addc9a8894a74f427d97313f90a9e
Signed-off-by: default avatarVijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: default avatarChandana Kishori Chiluveru <cchiluve@codeaurora.org>
parent 3162449f

drivers/usb/gadget/composite.c

+4 −0
Original line number Diff line number Diff line
@@ -1655,7 +1655,9 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) 
			if (!gadget_is_dualspeed(gadget) ||

			    gadget->speed >= USB_SPEED_SUPER)

				break;

			spin_lock(&cdev->lock);

			device_qual(cdev);

			spin_unlock(&cdev->lock);

			value = min_t(int, w_length,

				sizeof(struct usb_qualifier_descriptor));

			break;
@@ -1665,7 +1667,9 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) 
				break;

			/* FALLTHROUGH */

		case USB_DT_CONFIG:

			spin_lock(&cdev->lock);

			value = config_desc(cdev, w_value);

			spin_unlock(&cdev->lock);

			if (value >= 0)

				value = min(w_length, (u16) value);

			break;