[PATCH] usb: dwc3: gadget: fix race when disabling ep with cancelled xfers

* [PATCH] usb: dwc3: gadget: fix race when disabling ep with cancelled xfers
@ 2019-10-31  9:07 Felipe Balbi
  2019-10-31  9:15 ` Pavel Hofman
  0 siblings, 1 reply; 6+ messages in thread
From: Felipe Balbi @ 2019-10-31  9:07 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: Linux USB, Felipe Balbi, Roger Quadros

When disabling an endpoint which has cancelled requests, we should
make sure to giveback requests that are currently pending in the
cancelled list, otherwise we may fall into a situation where command
completion interrupt fires after endpoint has been disabled, therefore
causing a splat.

Fixes: fec9095bdef4 "usb: dwc3: gadget: remove wait_end_transfer"
Reported-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
---

Greg,

please apply this as a patch, if it's not too much to ask. Otherwise I
can add this to my pull request for the next merge window.

cheers

 drivers/usb/dwc3/gadget.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 86dc1db788a9..a9aba716bf80 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -707,6 +707,12 @@ static void dwc3_remove_requests(struct dwc3 *dwc, struct dwc3_ep *dep)
 
 		dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
 	}
+
+	while (!list_empty(&dep->cancelled_list)) {
+		req = next_request(&dep->cancelled_list);
+
+		dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
+	}
 }
 
 /**
-- 
2.23.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread