diff options
| author | Mayank Rana <mrana@codeaurora.org> | 2018-03-23 10:05:33 -0700 |
|---|---|---|
| committer | Felipe Balbi <felipe.balbi@linux.intel.com> | 2018-04-25 14:26:26 +0300 |
| commit | 96bd39df29c29d348d65311e5954c0b7d3a2a790 (patch) | |
| tree | b0818f4c428783647a50068bfba3051a8471fce9 | |
| parent | 9cffd15de0c322c574085759793dbbcfafa91746 (diff) | |
| download | linux-stable-96bd39df29c29d348d65311e5954c0b7d3a2a790.tar.gz linux-stable-96bd39df29c29d348d65311e5954c0b7d3a2a790.tar.bz2 linux-stable-96bd39df29c29d348d65311e5954c0b7d3a2a790.zip | |
usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue
dwc3_ep_dequeue() waits for completion of End Transfer command using
wait_event_lock_irq(), which will release the dwc3->lock while waiting
and reacquire after completion. This allows a potential race condition
with ep_disable() which also removes all requests from started_list
and pending_list.
The check for NULL r->trb should catch this but currently it exits to
the wrong 'out1' label which calls dwc3_gadget_giveback(). Since its
list entry was already removed, if CONFIG_DEBUG_LIST is enabled a
'list_del corruption' bug is thrown since its next/prev pointers are
already LIST_POISON1/2. If r->trb is NULL it should simply exit to
'out0'.
Fixes: cf3113d893d4 ("usb: dwc3: gadget: properly increment dequeue pointer on ep_dequeue")
Cc: stable@vger.kernel.org # v4.12+
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| -rw-r--r-- | drivers/usb/dwc3/gadget.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 206ecc7428da..0dedf8a799f4 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -1424,7 +1424,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep, dwc->lock); if (!r->trb) - goto out1; + goto out0; if (r->num_pending_sgs) { struct dwc3_trb *trb; |