Commit 73359cef authored by Felipe Balbi's avatar Felipe Balbi

usb: dwc3: gadget: WARN() on bogus usb_ep_queue()

Some gadget/function drivers might want to do
improper request recycling by allocating a single
request from one particular endpoint and queueing
it to another completely unrelated endpoint.

One such case was found with f_loopback.c.

To prevent such cases from happening again, let's
WARN() so we get a loud enough failure and persuade
users to report errors.
Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
parent 06a374ed
...@@ -1140,8 +1140,14 @@ static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request, ...@@ -1140,8 +1140,14 @@ static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
if (!dep->endpoint.desc) { if (!dep->endpoint.desc) {
dev_dbg(dwc->dev, "trying to queue request %p to disabled %s\n", dev_dbg(dwc->dev, "trying to queue request %p to disabled %s\n",
request, ep->name); request, ep->name);
spin_unlock_irqrestore(&dwc->lock, flags); ret = -ESHUTDOWN;
return -ESHUTDOWN; goto out;
}
if (WARN(req->dep != dep, "request %p belongs to '%s'\n",
request, req->dep->name)) {
ret = -EINVAL;
goto out;
} }
dev_vdbg(dwc->dev, "queing request %p to %s length %d\n", dev_vdbg(dwc->dev, "queing request %p to %s length %d\n",
...@@ -1149,6 +1155,8 @@ static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request, ...@@ -1149,6 +1155,8 @@ static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
trace_dwc3_ep_queue(req); trace_dwc3_ep_queue(req);
ret = __dwc3_gadget_ep_queue(dep, req); ret = __dwc3_gadget_ep_queue(dep, req);
out:
spin_unlock_irqrestore(&dwc->lock, flags); spin_unlock_irqrestore(&dwc->lock, flags);
return ret; return ret;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment