mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-03 15:47:36 +00:00
usb: gadget: u_audio: fix race condition on endpoint stop
[ Upstream commit068fdad204
] If the endpoint completion callback is call right after the ep_enabled flag is cleared and before usb_ep_dequeue() is call, we could do a double free on the request and the associated buffer. Fix this by clearing ep_enabled after all the endpoint requests have been dequeued. Fixes:7de8681be2
("usb: gadget: u_audio: Free requests only after callback") Cc: stable <stable@vger.kernel.org> Reported-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Signed-off-by: Jerome Brunet <jbrunet@baylibre.com> Link: https://lore.kernel.org/r/20210827092927.366482-1-jbrunet@baylibre.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
11f2193a1b
commit
69451fe8a8
1 changed files with 2 additions and 3 deletions
|
@ -358,8 +358,6 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
|
||||||
if (!prm->ep_enabled)
|
if (!prm->ep_enabled)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
prm->ep_enabled = false;
|
|
||||||
|
|
||||||
audio_dev = uac->audio_dev;
|
audio_dev = uac->audio_dev;
|
||||||
params = &audio_dev->params;
|
params = &audio_dev->params;
|
||||||
|
|
||||||
|
@ -377,11 +375,12 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
prm->ep_enabled = false;
|
||||||
|
|
||||||
if (usb_ep_disable(ep))
|
if (usb_ep_disable(ep))
|
||||||
dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__);
|
dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
int u_audio_start_capture(struct g_audio *audio_dev)
|
int u_audio_start_capture(struct g_audio *audio_dev)
|
||||||
{
|
{
|
||||||
struct snd_uac_chip *uac = audio_dev->uac;
|
struct snd_uac_chip *uac = audio_dev->uac;
|
||||||
|
|
Loading…
Reference in a new issue