Commit 974e9323 authored by Kevin Cernekee's avatar Kevin Cernekee Committed by Felipe Balbi

usb: gadget: udc-core: Race between disconnect/unbind and setup

usb_gadget_remove_driver() runs through a four-step sequence to shut down
the gadget driver.  For the case of a composite gadget + at91 UDC, this
would look like:

    udc->driver->disconnect(udc->gadget);          // composite_disconnect()
    usb_gadget_disconnect(udc->gadget);            // at91_pullup(gadget, 0)
    udc->driver->unbind(udc->gadget);              // composite_unbind()
    usb_gadget_udc_stop(udc->gadget, udc->driver); // at91_stop()

The UDC driver can receive SETUP packets from the host up until the
point when usb_gadget_disconnect() returns.  On rare occasions, the
gadget driver may see this sequence:

    udc->driver->disconnect(udc->gadget);          // composite_disconnect()
    udc->driver->setup(udc->gadget, &ctrl);        // composite_setup()
    udc->driver->unbind(udc->gadget);              // composite_unbind()

Some gadget drivers, such as composite, assume this will never happen
and crash as a result.

The fix is to quiesce the UDC hardware (via usb_gadget_disconnect)
before running the gadget driver through the disconnect/unbind sequence.
Reviewed-by: default avatarPeter Chen <peter.chen@freescale.com>
Signed-off-by: default avatarKevin Cernekee <cernekee@gmail.com>
Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
parent d3091cff
...@@ -262,8 +262,8 @@ static void usb_gadget_remove_driver(struct usb_udc *udc) ...@@ -262,8 +262,8 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE); kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
if (udc_is_newstyle(udc)) { if (udc_is_newstyle(udc)) {
udc->driver->disconnect(udc->gadget);
usb_gadget_disconnect(udc->gadget); usb_gadget_disconnect(udc->gadget);
udc->driver->disconnect(udc->gadget);
udc->driver->unbind(udc->gadget); udc->driver->unbind(udc->gadget);
usb_gadget_udc_stop(udc->gadget, udc->driver); usb_gadget_udc_stop(udc->gadget, udc->driver);
} else { } else {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment