From patchwork Wed Sep 1 12:26:57 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 505064 Delivered-To: patch@linaro.org Received: by 2002:a02:8629:0:0:0:0:0 with SMTP id e38csp204939jai; Wed, 1 Sep 2021 05:28:43 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzOo3xn1kjSspxN6yk+R+VuH30yxLw2jY7bOgm6Cypl1xhjmYwFkOjn/nPo1CyaapF8ElZA X-Received: by 2002:a17:906:60c2:: with SMTP id f2mr36723667ejk.531.1630499323234; Wed, 01 Sep 2021 05:28:43 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1630499323; cv=none; d=google.com; s=arc-20160816; b=H9p2Rlxx46D6SMx/5UMm4DPRQKe8KnrkeALdgNLWuKaApAGXDwIaP03v1rvp46eHLc F2d5FZbKco4FQDPTGIp3mxEsGyyewicpmax3JIQztPfPjjwsihcveluZ/fGvThFGpMLC xKfq4tvC9DUrsNfAQLZXxc9KxkuHHY/sbTN/DCJ7psN5fC7K3TC79T4JRXBtPuE2leci 3Hl3NA+ljL/N/KBghvAelSXx2rltEbxGoDruMH0hHStZSAbljwqys18ALsRl7v9Ob51u wJ329b4Ry5//JMLKfyrSRlA6zpHCoBx/wQuO1FVqk9C4jwYXZJOjo4LUl9By+CyE8NdL 6ZOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=xd8JiSqranj9xhE3NUG3Hqu2pDBqxRzQIEb5XpR0hag=; b=KwYBc80UY/tm6GcZ1Xxek+O9qxRh3iaPNkDFD744jg5vKuJCd6oBDQiqVOCB4HJfsh hMO5xfiFWwM4bXZn63k9ank24WtO75nMPKqvohDPXNig7+dAcirAFgAb3j/KIGwc3EsB DN9x8rAghoEdJuOnjBkt9RP0zChqJkUQwuvgN2bj1pOqTAJ8rZmu+YkPGIc5jUC0hDQH XSdMryW5mdEFD0FKs9HBZx09s1bVZqAm3RjAoCfos4bFthjuiCHHDnnCmLJikNvPldSZ io4k9P4yE8PyibVgWV0dcnKOCMx66/0sHmpQrshuWEEDgD1k1jFYaEyfsVDXMkyoC7/w J6bw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=kdxm0uc9; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id dp16si2177718ejc.294.2021.09.01.05.28.43; Wed, 01 Sep 2021 05:28:43 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=kdxm0uc9; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244374AbhIAM3i (ORCPT + 11 others); Wed, 1 Sep 2021 08:29:38 -0400 Received: from mail.kernel.org ([198.145.29.99]:58880 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244521AbhIAM3M (ORCPT ); Wed, 1 Sep 2021 08:29:12 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id E491560BD3; Wed, 1 Sep 2021 12:28:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1630499295; bh=MuizBMrN+DzZRiLcBUKgCQodBrtmAA4s5xT6DwAA5Hs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kdxm0uc9XD5XxzKUPycUv+yhiHrFhe4im+Vy6ByL8TPhVuBeSW36l/EjDImBgYQqn fWlXaY4UBTko9I2qMPFIQmz42fAKT2uF+xFlF9YpV3mVaiw4e0ZG329eEKCK5Ao3QS OOxc2MFBo96wsD8rROdQpam+hlMFj98o7SHXDQGg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thinh Nguyen , Jerome Brunet , Sasha Levin Subject: [PATCH 4.14 12/23] usb: gadget: u_audio: fix race condition on endpoint stop Date: Wed, 1 Sep 2021 14:26:57 +0200 Message-Id: <20210901122250.182380095@linuxfoundation.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20210901122249.786673285@linuxfoundation.org> References: <20210901122249.786673285@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jerome Brunet [ Upstream commit 068fdad20454f815e61e6f6eb9f051a8b3120e88 ] If the endpoint completion callback is call right after the ep_enabled flag is cleared and before usb_ep_dequeue() is call, we could do a double free on the request and the associated buffer. Fix this by clearing ep_enabled after all the endpoint requests have been dequeued. Fixes: 7de8681be2cd ("usb: gadget: u_audio: Free requests only after callback") Cc: stable Reported-by: Thinh Nguyen Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20210827092927.366482-1-jbrunet@baylibre.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/usb/gadget/function/u_audio.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.30.2 diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c index 0370a1314b88..af6339ff6d2f 100644 --- a/drivers/usb/gadget/function/u_audio.c +++ b/drivers/usb/gadget/function/u_audio.c @@ -358,8 +358,6 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) if (!prm->ep_enabled) return; - prm->ep_enabled = false; - audio_dev = uac->audio_dev; params = &audio_dev->params; @@ -377,11 +375,12 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) } } + prm->ep_enabled = false; + if (usb_ep_disable(ep)) dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__); } - int u_audio_start_capture(struct g_audio *audio_dev) { struct snd_uac_chip *uac = audio_dev->uac;