Commit 980900d6 authored by Chunfeng Yun's avatar Chunfeng Yun Committed by Felipe Balbi

usb: gadget: composite: fix delayed_status race condition when set_interface

It happens when enable debug log, if set_alt() returns
USB_GADGET_DELAYED_STATUS and usb_composite_setup_continue()
is called before increasing count of @delayed_status,
so fix it by using spinlock of @cdev->lock.
Signed-off-by: default avatarChunfeng Yun <chunfeng.yun@mediatek.com>
Tested-by: default avatarJay Hsu <shih-chieh.hsu@mediatek.com>
Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
parent 70c3c8cb
...@@ -1719,6 +1719,8 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) ...@@ -1719,6 +1719,8 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
*/ */
if (w_value && !f->get_alt) if (w_value && !f->get_alt)
break; break;
spin_lock(&cdev->lock);
value = f->set_alt(f, w_index, w_value); value = f->set_alt(f, w_index, w_value);
if (value == USB_GADGET_DELAYED_STATUS) { if (value == USB_GADGET_DELAYED_STATUS) {
DBG(cdev, DBG(cdev,
...@@ -1728,6 +1730,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) ...@@ -1728,6 +1730,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
DBG(cdev, "delayed_status count %d\n", DBG(cdev, "delayed_status count %d\n",
cdev->delayed_status); cdev->delayed_status);
} }
spin_unlock(&cdev->lock);
break; break;
case USB_REQ_GET_INTERFACE: case USB_REQ_GET_INTERFACE:
if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE)) if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment