usb: dwc3: gadget: Avoid use-after-free of stale requests
There is a possibility where cable disconnect can race with
composition switch. In this race if ep0 is stuck in DATA phase the
request queued couldn't be dequeued since USB went into LPM. This request
should have been given back by the gadget driver during ep0 disable but
ep0 disable was never called because of the failure of ep0 transition to
SETUP phase during pullup disable. This request which is still in the
pending list got freed by the composite device. This is leading to
use-after-free upon next connect. Avoid this by not bailing out if
timeout happened while waiting for SETUP phase and continue to
stop USB controller.
Change-Id: Ia76d491f758a058ef81aa1167cac53e5c3fd7808
Signed-off-by:
Pratham Pratap <prathampratap@codeaurora.org>
Loading
Please register or sign in to comment