OpenE2K/linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

usb: dwc3: gadget: Prevent EP queuing while stopping transfers

Browse Source 
[ Upstream commit f09ddcfcb8c569675066337adac2ac205113471f ]

In the situations where the DWC3 gadget stops active transfers, once
calling the dwc3_gadget_giveback(), there is a chance where a function
driver can queue a new USB request in between the time where the dwc3
lock has been released and re-aquired.  This occurs after we've already
issued an ENDXFER command.  When the stop active transfers continues
to remove USB requests from all dep lists, the newly added request will
also be removed, while controller still has an active TRB for it.
This can lead to the controller accessing an unmapped memory address.

Fix this by ensuring parameters to prevent EP queuing are set before
calling the stop active transfers API.

Fixes: ae7e86108b ("usb: dwc3: Stop active transfers before halting the controller")
Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
Link: https://lore.kernel.org/r/1615507142-23097-1-git-send-email-wcheng@codeaurora.org
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Wesley Cheng 2021-08-12 20:16:49 +03:00 committed by Greg Kroah-Hartman
parent 823f692508
commit e36245a68e
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/usb/dwc3/gadget.c
View File

@ -746,8 +746,6 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep)
trace_dwc3_gadget_ep_disable(dep); trace_dwc3_gadget_ep_disable(dep);
dwc3_remove_requests(dwc, dep);
/* make sure HW endpoint isn't stalled */ /* make sure HW endpoint isn't stalled */
if (dep->flags & DWC3_EP_STALL) if (dep->flags & DWC3_EP_STALL)
__dwc3_gadget_ep_set_halt(dep, 0, false); __dwc3_gadget_ep_set_halt(dep, 0, false);
@ -766,6 +764,8 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep)
dep->endpoint.desc = NULL; dep->endpoint.desc = NULL;
} }
dwc3_remove_requests(dwc, dep);
return 0; return 0;
} }
@ -1511,7 +1511,7 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
{ {
struct dwc3 *dwc = dep->dwc; struct dwc3 *dwc = dep->dwc;
if (!dep->endpoint.desc || !dwc->pullups_connected) { if (!dep->endpoint.desc || !dwc->pullups_connected || !dwc->connected) {
dev_err(dwc->dev, "%s: can't queue to disabled endpoint\n", dev_err(dwc->dev, "%s: can't queue to disabled endpoint\n",
dep->name); dep->name);
return -ESHUTDOWN; return -ESHUTDOWN;
@ -2043,6 +2043,7 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
if (!is_on) { if (!is_on) {
u32 count; u32 count;
dwc->connected = false;
/* /*
* In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a
* Section 4.1.8 Table 4-7, it states that for a device-initiated * Section 4.1.8 Table 4-7, it states that for a device-initiated
@ -2067,7 +2068,6 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
dwc->ev_buf->lpos = (dwc->ev_buf->lpos + count) % dwc->ev_buf->lpos = (dwc->ev_buf->lpos + count) %
dwc->ev_buf->length; dwc->ev_buf->length;
} }
dwc->connected = false;
} else { } else {
__dwc3_gadget_start(dwc); __dwc3_gadget_start(dwc);
} }
@ -3057,8 +3057,6 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)
{ {
u32 reg; u32 reg;
dwc->connected = true;
/* /*
* Ideally, dwc3_reset_gadget() would trigger the function * Ideally, dwc3_reset_gadget() would trigger the function
* drivers to stop any active transfers through ep disable. * drivers to stop any active transfers through ep disable.
@ -3107,6 +3105,7 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)
* transfers." * transfers."
*/ */
dwc3_stop_active_transfers(dwc); dwc3_stop_active_transfers(dwc);
dwc->connected = true;
reg = dwc3_readl(dwc->regs, DWC3_DCTL); reg = dwc3_readl(dwc->regs, DWC3_DCTL);
reg &= ~DWC3_DCTL_TSTCTRL_MASK; reg &= ~DWC3_DCTL_TSTCTRL_MASK;