* [PATCH] usb: dwc2: gadget: Fix kill_all_requests race
@ 2019-08-05 16:01 John Keeping
0 siblings, 0 replies; only message in thread
From: John Keeping @ 2019-08-05 16:01 UTC (permalink / raw)
To: Minas Harutyunyan; +Cc: linux-usb, Greg Kroah-Hartman, John Keeping
When a gadget is disabled, kill_all_requests() can be called
simultaneously from both a user process via dwc2_hsotg_pullup() and from
the interrupt handler if the hardware detects disconnection.
Since we drop the lock in dwc2_hsotg_complete_request() in order to call
the completion handler, this means that the list is modified
concurrently and leads to an infinite loop in kill_all_requests().
Replace the foreach loop with a while-not-empty loop in order to remove
the danger of this concurrent modification.
Note: I observed this with threadirqs, I'm not sure if it can be
triggered without threaded interrupts.
Signed-off-by: John Keeping <john@metanate.com>
---
drivers/usb/dwc2/gadget.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 60ac98cd8ad8..92e8de9cb45c 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3227,14 +3227,15 @@ static void kill_all_requests(struct dwc2_hsotg *hsotg,
struct dwc2_hsotg_ep *ep,
int result)
{
- struct dwc2_hsotg_req *req, *treq;
unsigned int size;
ep->req = NULL;
- list_for_each_entry_safe(req, treq, &ep->queue, queue)
- dwc2_hsotg_complete_request(hsotg, ep, req,
- result);
+ while (!list_empty(&ep->queue)) {
+ struct dwc2_hsotg_req *req = get_ep_head(ep);
+
+ dwc2_hsotg_complete_request(hsotg, ep, req, result);
+ }
if (!hsotg->dedicated_fifos)
return;
--
2.22.0
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2019-08-05 16:25 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-05 16:01 [PATCH] usb: dwc2: gadget: Fix kill_all_requests race John Keeping
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).