| From 96bd39df29c29d348d65311e5954c0b7d3a2a790 Mon Sep 17 00:00:00 2001 |
| From: Mayank Rana <mrana@codeaurora.org> |
| Date: Fri, 23 Mar 2018 10:05:33 -0700 |
| Subject: usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue |
| |
| From: Mayank Rana <mrana@codeaurora.org> |
| |
| commit 96bd39df29c29d348d65311e5954c0b7d3a2a790 upstream. |
| |
| dwc3_ep_dequeue() waits for completion of End Transfer command using |
| wait_event_lock_irq(), which will release the dwc3->lock while waiting |
| and reacquire after completion. This allows a potential race condition |
| with ep_disable() which also removes all requests from started_list |
| and pending_list. |
| |
| The check for NULL r->trb should catch this but currently it exits to |
| the wrong 'out1' label which calls dwc3_gadget_giveback(). Since its |
| list entry was already removed, if CONFIG_DEBUG_LIST is enabled a |
| 'list_del corruption' bug is thrown since its next/prev pointers are |
| already LIST_POISON1/2. If r->trb is NULL it should simply exit to |
| 'out0'. |
| |
| Fixes: cf3113d893d4 ("usb: dwc3: gadget: properly increment dequeue pointer on ep_dequeue") |
| Cc: stable@vger.kernel.org # v4.12+ |
| Signed-off-by: Mayank Rana <mrana@codeaurora.org> |
| Signed-off-by: Jack Pham <jackp@codeaurora.org> |
| Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/usb/dwc3/gadget.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/usb/dwc3/gadget.c |
| +++ b/drivers/usb/dwc3/gadget.c |
| @@ -1444,7 +1444,7 @@ static int dwc3_gadget_ep_dequeue(struct |
| dwc->lock); |
| |
| if (!r->trb) |
| - goto out1; |
| + goto out0; |
| |
| if (r->num_pending_sgs) { |
| struct dwc3_trb *trb; |
