mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 01:10:04 +00:00
usb: dwc3: avoid NULL access of usb_gadget_driver
we found crash in dwc3_disconnect_gadget(),
it is because dwc->gadget_driver become NULL before async access.
7dc0c55e9f
('USB: UDC core: Add udc_async_callbacks gadget op')
suggest a common way to avoid such kind of issue.
this change implment the callback in dwc3 and
change related functions which have callback to usb gadget driver.
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Linyu Yuan <linyyuan@codeaurora.org>
Link: https://lore.kernel.org/r/20210629015118.7944-1-linyyuan@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
b5fdf5c6e6
commit
40edb52298
3 changed files with 23 additions and 9 deletions
|
@ -1279,6 +1279,7 @@ struct dwc3 {
|
|||
unsigned dis_metastability_quirk:1;
|
||||
|
||||
unsigned dis_split_quirk:1;
|
||||
unsigned async_callbacks:1;
|
||||
|
||||
u16 imod_interval;
|
||||
};
|
||||
|
|
|
@ -597,11 +597,13 @@ static int dwc3_ep0_set_address(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
|
|||
|
||||
static int dwc3_ep0_delegate_req(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
|
||||
{
|
||||
int ret;
|
||||
int ret = -EINVAL;
|
||||
|
||||
spin_unlock(&dwc->lock);
|
||||
ret = dwc->gadget_driver->setup(dwc->gadget, ctrl);
|
||||
spin_lock(&dwc->lock);
|
||||
if (dwc->async_callbacks) {
|
||||
spin_unlock(&dwc->lock);
|
||||
ret = dwc->gadget_driver->setup(dwc->gadget, ctrl);
|
||||
spin_lock(&dwc->lock);
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
|
|
@ -2585,6 +2585,16 @@ static int dwc3_gadget_vbus_draw(struct usb_gadget *g, unsigned int mA)
|
|||
return ret;
|
||||
}
|
||||
|
||||
static void dwc3_gadget_async_callbacks(struct usb_gadget *g, bool enable)
|
||||
{
|
||||
struct dwc3 *dwc = gadget_to_dwc(g);
|
||||
unsigned long flags;
|
||||
|
||||
spin_lock_irqsave(&dwc->lock, flags);
|
||||
dwc->async_callbacks = enable;
|
||||
spin_unlock_irqrestore(&dwc->lock, flags);
|
||||
}
|
||||
|
||||
static const struct usb_gadget_ops dwc3_gadget_ops = {
|
||||
.get_frame = dwc3_gadget_get_frame,
|
||||
.wakeup = dwc3_gadget_wakeup,
|
||||
|
@ -2596,6 +2606,7 @@ static const struct usb_gadget_ops dwc3_gadget_ops = {
|
|||
.udc_set_ssp_rate = dwc3_gadget_set_ssp_rate,
|
||||
.get_config_params = dwc3_gadget_config_params,
|
||||
.vbus_draw = dwc3_gadget_vbus_draw,
|
||||
.udc_async_callbacks = dwc3_gadget_async_callbacks,
|
||||
};
|
||||
|
||||
/* -------------------------------------------------------------------------- */
|
||||
|
@ -3231,7 +3242,7 @@ static void dwc3_endpoint_interrupt(struct dwc3 *dwc,
|
|||
|
||||
static void dwc3_disconnect_gadget(struct dwc3 *dwc)
|
||||
{
|
||||
if (dwc->gadget_driver && dwc->gadget_driver->disconnect) {
|
||||
if (dwc->async_callbacks && dwc->gadget_driver->disconnect) {
|
||||
spin_unlock(&dwc->lock);
|
||||
dwc->gadget_driver->disconnect(dwc->gadget);
|
||||
spin_lock(&dwc->lock);
|
||||
|
@ -3240,7 +3251,7 @@ static void dwc3_disconnect_gadget(struct dwc3 *dwc)
|
|||
|
||||
static void dwc3_suspend_gadget(struct dwc3 *dwc)
|
||||
{
|
||||
if (dwc->gadget_driver && dwc->gadget_driver->suspend) {
|
||||
if (dwc->async_callbacks && dwc->gadget_driver->suspend) {
|
||||
spin_unlock(&dwc->lock);
|
||||
dwc->gadget_driver->suspend(dwc->gadget);
|
||||
spin_lock(&dwc->lock);
|
||||
|
@ -3249,7 +3260,7 @@ static void dwc3_suspend_gadget(struct dwc3 *dwc)
|
|||
|
||||
static void dwc3_resume_gadget(struct dwc3 *dwc)
|
||||
{
|
||||
if (dwc->gadget_driver && dwc->gadget_driver->resume) {
|
||||
if (dwc->async_callbacks && dwc->gadget_driver->resume) {
|
||||
spin_unlock(&dwc->lock);
|
||||
dwc->gadget_driver->resume(dwc->gadget);
|
||||
spin_lock(&dwc->lock);
|
||||
|
@ -3261,7 +3272,7 @@ static void dwc3_reset_gadget(struct dwc3 *dwc)
|
|||
if (!dwc->gadget_driver)
|
||||
return;
|
||||
|
||||
if (dwc->gadget->speed != USB_SPEED_UNKNOWN) {
|
||||
if (dwc->async_callbacks && dwc->gadget->speed != USB_SPEED_UNKNOWN) {
|
||||
spin_unlock(&dwc->lock);
|
||||
usb_gadget_udc_reset(dwc->gadget, dwc->gadget_driver);
|
||||
spin_lock(&dwc->lock);
|
||||
|
@ -3585,7 +3596,7 @@ static void dwc3_gadget_wakeup_interrupt(struct dwc3 *dwc)
|
|||
* implemented.
|
||||
*/
|
||||
|
||||
if (dwc->gadget_driver && dwc->gadget_driver->resume) {
|
||||
if (dwc->async_callbacks && dwc->gadget_driver->resume) {
|
||||
spin_unlock(&dwc->lock);
|
||||
dwc->gadget_driver->resume(dwc->gadget);
|
||||
spin_lock(&dwc->lock);
|
||||
|
|
Loading…
Reference in a new issue