diff options
author | Alexey Khoroshilov <khoroshilov@ispras.ru> | 2016-02-26 22:33:14 (GMT) |
---|---|---|
committer | Felipe Balbi <balbi@kernel.org> | 2016-03-04 13:14:47 (GMT) |
commit | cff5638ef7852196879f9687e70d49ea291bbb33 (patch) | |
tree | c5f7866cbd378848b28157ff007e37972f89db7f /drivers/usb/gadget | |
parent | ead22caf8507c0533aab6b89e26776414b477b6f (diff) | |
download | linux-cff5638ef7852196879f9687e70d49ea291bbb33.tar.xz |
usb: gadget: bdc_udc: fix race condition in bdc_udc_exit()
bdc_ep_disable() expects to be called with bdc->lock held.
The assumption is met in all the cases except for call from bdc_udc_exit(),
that is called from bdc_remove(). As a result a race can happen or unheld
bdc->lock can be unlocked in bdc_req_complete().
The patch proposes to acquire-release bdc->lock around bdc_ep_disable()
in bdc_udc_exit().
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Diffstat (limited to 'drivers/usb/gadget')
-rw-r--r-- | drivers/usb/gadget/udc/bdc/bdc_udc.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/usb/gadget/udc/bdc/bdc_udc.c b/drivers/usb/gadget/udc/bdc/bdc_udc.c index 7f77db5..aae7458 100644 --- a/drivers/usb/gadget/udc/bdc/bdc_udc.c +++ b/drivers/usb/gadget/udc/bdc/bdc_udc.c @@ -581,8 +581,13 @@ err0: void bdc_udc_exit(struct bdc *bdc) { + unsigned long flags; + dev_dbg(bdc->dev, "%s()\n", __func__); + spin_lock_irqsave(&bdc->lock, flags); bdc_ep_disable(bdc->bdc_ep_array[1]); + spin_unlock_irqrestore(&bdc->lock, flags); + usb_del_gadget_udc(&bdc->gadget); bdc_free_ep(bdc); } |