Jerome Brunet 068fdad204 usb: gadget: u_audio: fix race condition on endpoint stop
If the endpoint completion callback is call right after the ep_enabled flag
is cleared and before usb_ep_dequeue() is call, we could do a double free
on the request and the associated buffer.

Fix this by clearing ep_enabled after all the endpoint requests have been
dequeued.

Fixes: 7de8681be2cd ("usb: gadget: u_audio: Free requests only after callback")
Cc: stable <stable@vger.kernel.org>
Reported-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20210827092927.366482-1-jbrunet@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-08-27 16:07:23 +02:00
..
2021-08-20 21:11:43 +02:00
2021-07-30 10:56:47 -07:00
2021-06-30 15:51:09 -07:00
2021-08-16 06:16:25 -10:00
2021-06-30 15:34:19 -06:00
2021-08-21 11:27:16 -07:00
2021-07-10 09:22:44 -07:00
2021-06-17 17:37:18 -07:00
2021-08-06 11:08:24 -07:00
2021-07-13 15:15:17 +02:00
2021-08-15 06:38:26 -10:00
2021-07-10 11:53:06 -07:00
2021-07-09 15:35:13 +02:00
2021-07-05 14:08:24 -07:00
2021-08-07 10:26:21 -07:00
2021-08-03 09:33:05 -07:00
2021-06-30 12:12:56 -07:00
2021-07-05 13:51:41 -07:00
2021-08-16 06:36:01 -10:00
2021-07-24 12:57:06 -07:00
2021-07-03 10:54:08 -07:00
2021-08-20 12:51:37 -07:00
2021-08-16 11:11:06 +01:00
2021-07-21 12:37:49 -07:00
2021-07-07 10:50:03 -07:00
2021-07-10 09:46:20 -07:00
2021-07-10 16:19:10 -07:00
2021-08-14 19:51:58 -10:00
2021-08-16 22:42:02 +02:00
2021-08-06 11:15:02 -07:00
2021-08-16 06:16:25 -10:00
2021-07-03 11:49:33 -07:00
2021-07-16 11:14:54 -07:00
2021-07-07 12:57:46 -07:00
2021-08-14 06:31:22 -10:00
2021-06-16 08:53:58 -06:00
2021-06-29 11:21:35 -07:00