A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 16:16:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

USB: f_fs: Fix epfile crash during composition switch

Browse source 
epfile's ep pointer may be NULL during adb transfer
and composition switch happening in parallel. As part
of composition switch, first it is set to NONE. Setting
sys.usb.config to NONE stops adb and disables the composition.
stop adb is not blocking call and adb still might be doing
epfile read/write for some time when function unbind is
ongoing making the data structures NULL.

To fix this crash, call usb_ep_dequeue only if ep->ep is
valid. Similarly in success case, return ep->status only
if ep->ep is valid otherwise return -ENODEV.

Change-Id: Ic152fc1db31cad6f97b8d16d91350dad857a4bf9
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
This commit is contained in:
Sujeet Kumar 2016-11-10 18:41:38 -08:00 • committed by Gerrit - the friendly Code Review server
commit a4c534819e
1 changed files with 18 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

25
drivers/usb/gadget/function/f_fs.c
View file

@ -1171,21 +1171,32 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
* status. usb_ep_dequeue API should guarantee no race
* condition with req->complete callback.
*/
usb_ep_dequeue(ep->ep, req);
wait_for_completion(&done);
interrupted = ep->status < 0;
spin_lock_irq(&epfile->ffs->eps_lock);
interrupted = true;
if (ep->ep) {
usb_ep_dequeue(ep->ep, req);
wait_for_completion(&done);
interrupted = ep->status < 0;
}
spin_unlock_irq(&epfile->ffs->eps_lock);
}
ffs_log("%s:ep status %d for req %pK", epfile->name, ep->status,
req);
if (interrupted)
if (interrupted) {
ret = -EINTR;
else if (io_data->read && ep->status > 0)
goto error_mutex;
}
ret = -ENODEV;
spin_lock_irq(&epfile->ffs->eps_lock);
if (ep->ep)
ret = ep->status;
spin_unlock_irq(&epfile->ffs->eps_lock);
if (io_data->read && ret > 0)
ret = __ffs_epfile_read_data(epfile, data, ep->status,
&io_data->data);
else
ret = ep->status;
goto error_mutex;
} else if (!(req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC))) {
ret = -ENOMEM;