usb: dwc3: Do not traverse list using list_for_each_safe
There is a possibility of race between endpoint transfer
completion context and stop active transfer context. As
a result dwc3_cleanup_done_reqs() iterates over started_list
using list_for_each_safe while dwc3_remove_requests() is
deleting req from started list. While iterating over current
list node list_for_each_safe caches next list node. If the
cached list node is getting deleted by dwc3_remove_requests()
then request for same list node would be given back as part of
endpoint transfer completion. This result into list_del
corruption because list node is getting deleted twice. Fix
this issue by iterating started_list using while loop and
always accessing first node from list head.
Change-Id: I64104a43ade015923deeb1f230a17dea08817052
Signed-off-by:
Hemant Kumar <hemantk@codeaurora.org>
Loading
Please register or sign in to comment