Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 5f4a385f authored by Chandana Kishori Chiluveru's avatar Chandana Kishori Chiluveru
Browse files

usb: dwc3: Disable the irq before clearing run_stop bit



During composition switch dwc3_gadget_pullup() is called to perform a
disconnect, the driver must ensure that no transfers are in progress
before clearing the run/stop bit. Currently there is a check which
ensures ep0 is in EP0_SETUP_PHASE and if not simply waits for any
pending control transfer to conclude and return to that initial state.
Their is a case where host sending a Setup packet just before clear
run/stop bit in pullup disable before the dwc->lock is acquired, this
allows for a race in which a ep0 queue is failed with -ESHUTDOWN
and marking the freed request status(req->status) pointer to null.
After that when the request is allocated from next bind kernel panic
is seen with object poison overwritten with req->status pointer.

To fix this issue by disabling the irq before clearing the run-stop bit
so that interrupt handling for setup packet is prevented.

Change-Id: I979da8536bd6766153e25cf6120f00f348427a72
Signed-off-by: default avatarChandana Kishori Chiluveru <cchiluve@codeaurora.org>
parent 3de39b55
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment