• John Keeping's avatar
    usb: dwc2: gadget: Fix kill_all_requests race · 37bea42f
    John Keeping authored
    When a gadget is disabled, kill_all_requests() can be called
    simultaneously from both a user process via dwc2_hsotg_pullup() and from
    the interrupt handler if the hardware detects disconnection.
    
    Since we drop the lock in dwc2_hsotg_complete_request() in order to call
    the completion handler, this means that the list is modified
    concurrently and leads to an infinite loop in kill_all_requests().
    
    Replace the foreach loop with a while-not-empty loop in order to remove
    the danger of this concurrent modification.
    
    Note: I observed this with threadirqs, I'm not sure if it can be
    triggered without threaded interrupts.
    Signed-off-by: default avatarJohn Keeping <john@metanate.com>
    Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
    37bea42f
gadget.c 137 KB