Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c5c7f4d3 authored by Benoit Goby's avatar Benoit Goby Committed by Ruchi Kandoi
Browse files

usb: gadget: composite: Fix corruption when changing configuration 



Remove the config from the configs list before releasing the spinlock.
Otherwise the other cpu might be processing a SET_CONFIGURATION that
will switch to the configuration that is being released.

Change-Id: Id4da0d0e18ead63e20cb236cd1d3e8e6d116acce
Signed-off-by: default avatarBenoit Goby <benoit@android.com>
parent e7051b40

drivers/usb/gadget/composite.c

+6 −4
Original line number Diff line number Diff line
@@ -845,7 +845,7 @@ done: 
}

EXPORT_SYMBOL_GPL(usb_add_config);



static void remove_config(struct usb_composite_dev *cdev,

static void unbind_config(struct usb_composite_dev *cdev,

			      struct usb_configuration *config)

{

	while (!list_empty(&config->functions)) {
@@ -860,7 +860,6 @@ static void remove_config(struct usb_composite_dev *cdev, 
			/* may free memory for "f" */

		}

	}

	list_del(&config->list);

	if (config->unbind) {

		DBG(cdev, "unbind config '%s'/%p\n", config->label, config);

		config->unbind(config);
@@ -887,9 +886,11 @@ void usb_remove_config(struct usb_composite_dev *cdev, 
	if (cdev->config == config)

		reset_config(cdev);



	list_del(&config->list);



	spin_unlock_irqrestore(&cdev->lock, flags);



	remove_config(cdev, config);

	unbind_config(cdev, config);

}



/*-------------------------------------------------------------------------*/
@@ -1818,7 +1819,8 @@ static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver) 
		struct usb_configuration	*c;

		c = list_first_entry(&cdev->configs,

				struct usb_configuration, list);

		remove_config(cdev, c);

		list_del(&c->list);

		unbind_config(cdev, c);

	}

	if (cdev->driver->unbind && unbind_driver)

		cdev->driver->unbind(cdev);