mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 17:30:02 +00:00
usb: gadget: udc: renesas_usb3: Fix a race in usb3_start_pipen()
The usb3_start_pipen() is called by renesas_usb3_ep_queue() and
usb3_request_done_pipen() so that usb3_start_pipen() is possible
to cause a race when getting usb3_first_req like below:
renesas_usb3_ep_queue()
spin_lock_irqsave()
list_add_tail()
spin_unlock_irqrestore()
usb3_start_pipen()
usb3_first_req = usb3_get_request() --- [1]
--- interrupt ---
usb3_irq_dma_int()
usb3_request_done_pipen()
usb3_get_request()
usb3_start_pipen()
usb3_first_req = usb3_get_request()
...
(the req is possible to be finished in the interrupt)
The usb3_first_req [1] above may have been finished after the interrupt
ended so that this driver caused to start a transfer wrongly. To fix this
issue, getting/checking the usb3_first_req are under spin_lock_irqsave()
in the same section.
Fixes: 746bfe63bb
("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/20210524060155.1178724-1-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
a20dcf53ea
commit
e752dbc59e
1 changed files with 3 additions and 2 deletions
|
@ -1488,7 +1488,7 @@ static void usb3_start_pipen(struct renesas_usb3_ep *usb3_ep,
|
|||
struct renesas_usb3_request *usb3_req)
|
||||
{
|
||||
struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);
|
||||
struct renesas_usb3_request *usb3_req_first = usb3_get_request(usb3_ep);
|
||||
struct renesas_usb3_request *usb3_req_first;
|
||||
unsigned long flags;
|
||||
int ret = -EAGAIN;
|
||||
u32 enable_bits = 0;
|
||||
|
@ -1496,7 +1496,8 @@ static void usb3_start_pipen(struct renesas_usb3_ep *usb3_ep,
|
|||
spin_lock_irqsave(&usb3->lock, flags);
|
||||
if (usb3_ep->halt || usb3_ep->started)
|
||||
goto out;
|
||||
if (usb3_req != usb3_req_first)
|
||||
usb3_req_first = __usb3_get_request(usb3_ep);
|
||||
if (!usb3_req_first || usb3_req != usb3_req_first)
|
||||
goto out;
|
||||
|
||||
if (usb3_pn_change(usb3, usb3_ep->num) < 0)
|
||||
|
|
Loading…
Reference in a new issue