• Mayank Rana's avatar
    usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue · 05645366
    Mayank Rana authored
    dwc3_ep_dequeue() waits for completion of End Transfer command using
    wait_event_lock_irq(), which will release the dwc3->lock while waiting
    and reacquire after completion. This allows a potential race condition
    with ep_disable() which also removes all requests from started_list
    and pending_list.
    
    The check for NULL r->trb should catch this but currently it exits to
    the wrong 'out1' label which calls dwc3_gadget_giveback(). Since its
    list entry was already removed, if CONFIG_DEBUG_LIST is enabled a
    'list_del corruption' bug is thrown since its next/prev pointers are
    already LIST_POISON1/2. If r->trb is NULL it should simply exit to
    'out0'.
    
    Fixes: cf3113d8 ("usb: dwc3: gadget: properly increment dequeue pointer on ep_dequeue")
    Cc: stable@vger.kernel.org # v4.12+
    Signed-off-by: default avatarMayank Rana <mrana@codeaurora.org>
    Signed-off-by: default avatarJack Pham <jackp@codeaurora.org>
    Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
    05645366
gadget.c 81.4 KB