usb: dwc3: Disable the irq before clearing run_stop bit
During composition switch dwc3_gadget_pullup() is called to perform a
disconnect, the driver must ensure that no transfers are in progress
before clearing the run/stop bit. Currently there is a check which
ensures ep0 is in EP0_SETUP_PHASE and if not simply waits for any
pending control transfer to conclude and return to that initial state.
Their is a case where host sending a Setup packet just before clear
run/stop bit in pullup disable before the dwc->lock is acquired, this
allows for a race in which a ep0 queue is failed with -ESHUTDOWN
and marking the freed request status(req->status) pointer to null.
After that when the request is allocated from next bind kernel panic
is seen with object poison overwritten with req->status pointer.
To fix this issue by disabling the irq before clearing the run-stop bit
so that interrupt handling for setup packet is prevented.
Change-Id: I979da8536bd6766153e25cf6120f00f348427a72
Signed-off-by:
Chandana Kishori Chiluveru <cchiluve@codeaurora.org>
Loading
Please register or sign in to comment