Commit dae9523a authored Feb 11, 2013 by Manu Gautam Committed by Sriharsha Allenki Jan 08, 2019

usb: dwc3: gadget: Fail request submission if it was already queued



Function driver should not try to queue a busy request again to DCD
until DCD returns it by calling its completion handler or it is
explicitly dequeued. Some buggy function driver may try to submit a
request again which is with DCD resulting in corruption of request_list
leading to crash later in giveback. Catch such conditions and fail the
request submission to DCD.

CRs-Fixed: 447192
Change-Id: Id2a4a1720f61dffc50cc22598734f229caf07ff3
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Signed-off-by: Mayank Rana <mrana@codeaurora.org>

parent 2d0bbcbf

drivers/usb/dwc3/gadget.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -1504,6 +1504,13 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep dep, struct dwc3_request req)
		&req->request, req->dep->name))
		return -EINVAL;

		if (req->request.status == -EINPROGRESS) {
		ret = -EBUSY;
		dev_err(dwc->dev, "%s: %pK request already in queue",
		dep->name, req);
		return ret;
		}

		req->request.actual = 0;
		req->request.status = -EINPROGRESS;
		req->direction = dep->direction;