Mayank Rana 05645366f3
usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue ...
dwc3_ep_dequeue() waits for completion of End Transfer command using
wait_event_lock_irq(), which will release the dwc3->lock while waiting
and reacquire after completion. This allows a potential race condition
with ep_disable() which also removes all requests from started_list
and pending_list.
The check for NULL r->trb should catch this but currently it exits to
the wrong 'out1' label which calls dwc3_gadget_giveback(). Since its
list entry was already removed, if CONFIG_DEBUG_LIST is enabled a
'list_del corruption' bug is thrown since its next/prev pointers are
already LIST_POISON1/2. If r->trb is NULL it should simply exit to
'out0'.
Fixes: cf3113d893stable@vger.kernel.org # v4.12+
Signed-off-by: Mayank Rana <mrana@codeaurora.org >
Signed-off-by: Jack Pham <jackp@codeaurora.org >
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com >
2018-05-21 10:36:14 +03:00
2018-04-12 11:04:35 -07:00
2018-04-03 17:42:25 -07:00
2018-04-19 13:41:49 -04:00
2018-03-13 18:16:38 +01:00
2018-04-11 10:28:31 -07:00
2018-03-13 18:47:47 +02:00
2018-04-16 09:38:40 +02:00
2018-04-01 21:43:02 +03:00
2018-04-06 18:31:06 -07:00
2018-03-09 08:06:35 -07:00
2018-04-21 21:20:48 -07:00
2018-04-13 15:51:06 -07:00
2018-04-19 13:21:35 +02:00
2018-04-10 08:40:45 +02:00
2018-04-09 11:54:57 +02:00
2018-04-07 19:04:02 +09:00
2018-04-19 15:11:50 -07:00
2018-04-10 12:14:37 -07:00
2018-04-05 14:21:13 -07:00
2018-04-04 20:07:20 -07:00
2018-04-13 16:32:16 -07:00
2018-03-27 09:51:22 +02:00
2018-03-19 14:18:22 -05:00
2018-03-14 19:11:01 +01:00
2018-04-05 21:03:42 -07:00
2018-04-22 17:14:29 -07:00
2018-04-19 09:25:15 +02:00
2018-03-19 16:31:07 +01:00
2018-04-09 11:42:31 -07:00
2018-04-09 19:59:54 -07:00
2018-04-04 20:07:20 -07:00
2018-04-11 23:33:46 +02:00
2018-04-05 14:27:02 -07:00
2018-04-05 09:51:41 -07:00
2018-04-06 17:35:43 -07:00
2018-04-13 16:20:36 -07:00
2018-04-11 18:50:41 -07:00
2018-04-11 18:50:41 -07:00
2018-04-12 21:46:10 -04:00
2018-03-20 20:28:00 +01:00
2018-03-29 17:29:09 -06:00
2018-04-07 12:08:19 -07:00
2018-03-20 11:15:54 +08:00
2018-03-19 14:20:24 -05:00
2018-04-20 10:39:44 -07:00
2018-04-10 12:09:27 -07:00
2018-03-07 16:52:19 +01:00
2018-03-26 11:13:09 +02:00
2018-04-10 22:25:07 -07:00
2018-04-12 10:21:19 -07:00
2018-04-20 10:41:31 -07:00
2018-04-11 16:39:34 -07:00
2018-04-19 16:35:09 -04:00
2018-04-19 15:10:56 -07:00
2018-04-12 09:58:27 -06:00
2018-04-04 20:07:20 -07:00
2018-04-15 17:21:30 -07:00
2018-03-29 15:07:48 -04:00
2018-03-27 18:52:22 +02:00
2018-04-04 20:07:20 -07:00
2018-04-11 08:46:50 -05:00
2018-04-09 09:26:36 -07:00
2018-04-05 21:29:35 -07:00
2018-04-05 21:21:08 -07:00
2018-04-05 09:51:41 -07:00
2018-04-13 16:20:36 -07:00
2018-04-05 21:21:08 -07:00
2018-03-19 00:02:24 +01:00
2018-03-14 17:53:06 +01:00
2018-04-13 15:46:21 -07:00
2018-04-20 17:18:35 -07:00
2018-03-28 10:33:53 +08:00
2018-04-05 22:53:16 -07:00
2018-03-27 11:03:43 +02:00
2018-03-27 21:54:37 -07:00
2018-04-10 10:22:27 -07:00
2018-04-16 09:10:24 +02:00
2018-04-01 20:07:00 -04:00
2018-04-15 17:24:12 -07:00
2018-03-15 18:07:46 +01:00
2018-03-15 17:55:52 +01:00
2018-04-13 15:51:06 -07:00
2018-04-03 12:06:21 -07:00
2018-03-13 18:48:29 +02:00
2018-04-11 10:28:39 -07:00
2018-04-05 14:27:02 -07:00
2018-04-13 14:11:53 +08:00
2018-03-14 14:26:38 +03:00
2018-04-09 09:04:10 -07:00
2018-03-06 09:57:17 -08:00
2018-05-21 10:36:14 +03:00
2018-03-09 09:31:26 -08:00
2018-04-06 19:44:27 -07:00
2018-04-11 10:54:06 -04:00
2018-04-10 10:20:00 -07:00
2018-04-11 18:58:27 -07:00
2018-03-14 14:58:50 +01:00
2018-04-16 10:22:40 +02:00
2018-04-20 08:36:04 -07:00
2018-03-19 10:26:46 +01:00
2018-03-29 13:38:10 +03:00
05645366f3