summaryrefslogtreecommitdiffstats
path: root/drivers/usb/dwc2/hcd_queue.c
diff options
context:
space:
mode:
authorGregory Herrero <gregory.herrero@intel.com>2015-04-29 22:09:15 +0200
committerFelipe Balbi <balbi@ti.com>2015-04-29 22:19:55 +0200
commit33ad261aa62be02f0cedeb4d5735cc726de84a3f (patch)
tree813c94cc9394145e309c77882c5f5427894da83b /drivers/usb/dwc2/hcd_queue.c
parentusb: dwc2: host: resume root hub on port connect (diff)
downloadlinux-33ad261aa62be02f0cedeb4d5735cc726de84a3f.tar.xz
linux-33ad261aa62be02f0cedeb4d5735cc726de84a3f.zip
usb: dwc2: host: spinlock urb_enqueue
During urb_enqueue, if the urb can't be queued to the endpoint, the urb is freed without any spinlock protection. This leads to memory corruption when concurrent urb_dequeue try to free same urb->hcpriv. Thus, ensure the whole urb_enqueue in spinlocked. Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
Diffstat (limited to 'drivers/usb/dwc2/hcd_queue.c')
-rw-r--r--drivers/usb/dwc2/hcd_queue.c8
1 files changed, 1 insertions, 7 deletions
diff --git a/drivers/usb/dwc2/hcd_queue.c b/drivers/usb/dwc2/hcd_queue.c
index bb97838bc6c0..63207dc3cb22 100644
--- a/drivers/usb/dwc2/hcd_queue.c
+++ b/drivers/usb/dwc2/hcd_queue.c
@@ -761,6 +761,7 @@ void dwc2_hcd_qtd_init(struct dwc2_qtd *qtd, struct dwc2_hcd_urb *urb)
/**
* dwc2_hcd_qtd_add() - Adds a QTD to the QTD-list of a QH
+ * Caller must hold driver lock.
*
* @hsotg: The DWC HCD structure
* @qtd: The QTD to add
@@ -777,7 +778,6 @@ int dwc2_hcd_qtd_add(struct dwc2_hsotg *hsotg, struct dwc2_qtd *qtd,
struct dwc2_qh **qh, gfp_t mem_flags)
{
struct dwc2_hcd_urb *urb = qtd->urb;
- unsigned long flags;
int allocated = 0;
int retval;
@@ -792,15 +792,12 @@ int dwc2_hcd_qtd_add(struct dwc2_hsotg *hsotg, struct dwc2_qtd *qtd,
allocated = 1;
}
- spin_lock_irqsave(&hsotg->lock, flags);
-
retval = dwc2_hcd_qh_add(hsotg, *qh);
if (retval)
goto fail;
qtd->qh = *qh;
list_add_tail(&qtd->qtd_list_entry, &(*qh)->qtd_list);
- spin_unlock_irqrestore(&hsotg->lock, flags);
return 0;
@@ -817,10 +814,7 @@ fail:
qtd_list_entry)
dwc2_hcd_qtd_unlink_and_free(hsotg, qtd2, qh_tmp);
- spin_unlock_irqrestore(&hsotg->lock, flags);
dwc2_hcd_qh_free(hsotg, qh_tmp);
- } else {
- spin_unlock_irqrestore(&hsotg->lock, flags);
}
return retval;