iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

usb: dwc2: gadget: Fix kill_all_requests race

Browse Source 
When a gadget is disabled, kill_all_requests() can be called
simultaneously from both a user process via dwc2_hsotg_pullup() and from
the interrupt handler if the hardware detects disconnection.

Since we drop the lock in dwc2_hsotg_complete_request() in order to call
the completion handler, this means that the list is modified
concurrently and leads to an infinite loop in kill_all_requests().

Replace the foreach loop with a while-not-empty loop in order to remove
the danger of this concurrent modification.

Note: I observed this with threadirqs, I'm not sure if it can be
triggered without threaded interrupts.

Signed-off-by: John Keeping <john@metanate.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
This commit is contained in:
John Keeping 2019-08-05 17:01:21 +01:00 committed by Felipe Balbi
parent 27125cf8b5
commit 37bea42fec
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/usb/dwc2/gadget.c
View File

@ -3224,14 +3224,15 @@ static void kill_all_requests(struct dwc2_hsotg *hsotg,
struct dwc2_hsotg_ep *ep, struct dwc2_hsotg_ep *ep,
int result) int result)
{ {
struct dwc2_hsotg_req *req, *treq;
unsigned int size; unsigned int size;
ep->req = NULL; ep->req = NULL;
list_for_each_entry_safe(req, treq, &ep->queue, queue) while (!list_empty(&ep->queue)) {
dwc2_hsotg_complete_request(hsotg, ep, req, struct dwc2_hsotg_req *req = get_ep_head(ep);
result);
dwc2_hsotg_complete_request(hsotg, ep, req, result);
}
if (!hsotg->dedicated_fifos) if (!hsotg->dedicated_fifos)
return; return;