| From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> |
| Date: Mon, 21 May 2018 20:18:07 +0900 |
| Subject: usb: gadget: function: printer: avoid wrong list handling in |
| printer_write() |
| |
| commit 4a014a7339f441b0851ce012f469c0fadac61c81 upstream. |
| |
| When printer_write() calls usb_ep_queue(), a udc driver (e.g. |
| renesas_usbhs driver) may call usb_gadget_giveback_request() in |
| the udc .queue ops immediately. Then, printer_write() calls |
| list_add(&req->list, &dev->tx_reqs_active) wrongly. After that, |
| if we do unbind the printer driver, WARN_ON() happens in |
| printer_func_unbind() because the list entry is not removed. |
| |
| So, this patch moves list_add(&req->list, &dev->tx_reqs_active) |
| calling before usb_ep_queue(). |
| |
| Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> |
| Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| [bwh: Backported to 3.16: adjust filename] |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/usb/gadget/printer.c | 6 +++--- |
| 1 file changed, 3 insertions(+), 3 deletions(-) |
| |
| --- a/drivers/usb/gadget/printer.c |
| +++ b/drivers/usb/gadget/printer.c |
| @@ -667,19 +667,19 @@ printer_write(struct file *fd, const cha |
| return -EAGAIN; |
| } |
| |
| + list_add(&req->list, &dev->tx_reqs_active); |
| + |
| /* here, we unlock, and only unlock, to avoid deadlock. */ |
| spin_unlock(&dev->lock); |
| value = usb_ep_queue(dev->in_ep, req, GFP_ATOMIC); |
| spin_lock(&dev->lock); |
| if (value) { |
| + list_del(&req->list); |
| list_add(&req->list, &dev->tx_reqs); |
| spin_unlock_irqrestore(&dev->lock, flags); |
| mutex_unlock(&dev->lock_printer_io); |
| return -EAGAIN; |
| } |
| - |
| - list_add(&req->list, &dev->tx_reqs_active); |
| - |
| } |
| |
| spin_unlock_irqrestore(&dev->lock, flags); |