Commit 26a19ea6 authored by Gregory Herrero's avatar Gregory Herrero Committed by Felipe Balbi

usb: dwc2: host: fix use of qtd after free in desc dma mode

When completing non isoc xfer, dwc2_complete_non_isoc_xfer_ddma()
is relying on qtd->n_desc to process the corresponding number of
descriptors.

During the processing of these descriptors, qtd could be unlinked
and freed if xfer is done and urb is no more in progress.

In this case, dwc2_complete_non_isoc_xfer_ddma() will read again
qtd->n_desc whereas qtd has been freed. This will lead to unpredictable
results since qtd->n_desc is no more valid value.

To avoid this error, return a result != 0 in dwc2_process_non_isoc_desc(),
so that dwc2_complete_non_isoc_xfer_ddma() stops desc processing.

This has been seen with Slub debug enabled.
Acked-by: default avatarJohn Youn <johnyoun@synopsys.com>
Signed-off-by: default avatarGregory Herrero <gregory.herrero@intel.com>
Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
parent c503b381
...@@ -1033,7 +1033,10 @@ static int dwc2_process_non_isoc_desc(struct dwc2_hsotg *hsotg, ...@@ -1033,7 +1033,10 @@ static int dwc2_process_non_isoc_desc(struct dwc2_hsotg *hsotg,
failed = dwc2_update_non_isoc_urb_state_ddma(hsotg, chan, qtd, dma_desc, failed = dwc2_update_non_isoc_urb_state_ddma(hsotg, chan, qtd, dma_desc,
halt_status, n_bytes, halt_status, n_bytes,
xfer_done); xfer_done);
if (failed || (*xfer_done && urb->status != -EINPROGRESS)) { if (*xfer_done && urb->status != -EINPROGRESS)
failed = 1;
if (failed) {
dwc2_host_complete(hsotg, qtd, urb->status); dwc2_host_complete(hsotg, qtd, urb->status);
dwc2_hcd_qtd_unlink_and_free(hsotg, qtd, qh); dwc2_hcd_qtd_unlink_and_free(hsotg, qtd, qh);
dev_vdbg(hsotg->dev, "failed=%1x xfer_done=%1x status=%08x\n", dev_vdbg(hsotg->dev, "failed=%1x xfer_done=%1x status=%08x\n",
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment