From cff5638ef7852196879f9687e70d49ea291bbb33 Mon Sep 17 00:00:00 2001 From: Alexey Khoroshilov Date: Sat, 27 Feb 2016 01:33:14 +0300 Subject: [PATCH] usb: gadget: bdc_udc: fix race condition in bdc_udc_exit() bdc_ep_disable() expects to be called with bdc->lock held. The assumption is met in all the cases except for call from bdc_udc_exit(), that is called from bdc_remove(). As a result a race can happen or unheld bdc->lock can be unlocked in bdc_req_complete(). The patch proposes to acquire-release bdc->lock around bdc_ep_disable() in bdc_udc_exit(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: Felipe Balbi --- drivers/usb/gadget/udc/bdc/bdc_udc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/gadget/udc/bdc/bdc_udc.c b/drivers/usb/gadget/udc/bdc/bdc_udc.c index 7f77db5d1278..aae7458d8986 100644 --- a/drivers/usb/gadget/udc/bdc/bdc_udc.c +++ b/drivers/usb/gadget/udc/bdc/bdc_udc.c @@ -581,8 +581,13 @@ err0: void bdc_udc_exit(struct bdc *bdc) { + unsigned long flags; + dev_dbg(bdc->dev, "%s()\n", __func__); + spin_lock_irqsave(&bdc->lock, flags); bdc_ep_disable(bdc->bdc_ep_array[1]); + spin_unlock_irqrestore(&bdc->lock, flags); + usb_del_gadget_udc(&bdc->gadget); bdc_free_ep(bdc); } -- 2.39.5