From patchwork Wed Sep 1 12:28:08 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 505065 Delivered-To: patch@linaro.org Received: by 2002:a02:8629:0:0:0:0:0 with SMTP id e38csp206434jai; Wed, 1 Sep 2021 05:30:35 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyxE7Dhw7GVJBxvx+YM3upyqufma3zAPM2oJwGxVfZfqjeI0E0QH+sN1Vuxb25f3zSa2WMw X-Received: by 2002:a17:906:4f97:: with SMTP id o23mr36836356eju.418.1630499435367; Wed, 01 Sep 2021 05:30:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1630499435; cv=none; d=google.com; s=arc-20160816; b=GDo9OmyNbUs1Hlb9rkhTNb9bGmUjMcyhgxj0r2tSomeviOmXcMogJJrZbCyhmGW/tu nM9B31+VMhZIDq3Tt02vfcYTgTOKcAQ5Lc0M+RB5HmJjdUOXhMS179qCeh0Bu/PuUa3h 6s1B+DW8T7aR/9HbA1Pm32vw4TTiy5a0MU+52FVhTwW5AEwS/FT9PirsTPD1HYKdUjXZ HCFyZ7LvZWtk8SHKQnr5T9Iir2FFSsOFjmqXE7BqkSGsZdILBfvQTN9+Yvz/KEKyrL5/ sv82mp1pgKJrMtu1VT0fJYwHMQ9irM9KbUbpg8uVU9SW7UFRp77BWw8APzKqNB7mVcgk GmUg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=QX/s0SIGLSDlPVTKVONhyrUX9g4S+GENgULL7n7sOcI=; b=tLNSg4Uf6s+2RsgidUDXZvMBxV/FWIPEoGHS9nDcKoUM0RvISsrQ9yhI+9EZphotoi YQsEkgA20uC4cGqxOu8CMk18QcPQcALWfBwYbuSaeVijW2ptMGE8g//1Mktc95aDRbu4 lHqRbtVVI1qmVS8vAs75K90CDlTABtEN8pLHq2HZAXuhtFn+tel6SvDxB8R+ccbpzstc Hd7QAwLayzyL7LKPMNvDAPej+mQqocHtP/uSvCzVUXOfocHFn1spKIJLdcXUAGqRJ791 vEC+di7HM3uBrCFqseNuLSp6sl6LI+wycNoFCak6w4zNiC1hQSD92RpOFVlRwSpXoWle H/bw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=0K5aA6lp; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id g25si21048134edy.593.2021.09.01.05.30.35; Wed, 01 Sep 2021 05:30:35 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=0K5aA6lp; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244746AbhIAMbY (ORCPT + 11 others); Wed, 1 Sep 2021 08:31:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:33016 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244759AbhIAMa4 (ORCPT ); Wed, 1 Sep 2021 08:30:56 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 9095D610C7; Wed, 1 Sep 2021 12:29:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1630499400; bh=LNw1LN2KmhdUknF9aVBkHRYrex1DUDnnDZvCD9OTWqo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0K5aA6lp//rsTXV1IF5G63nT0FvpBVru63P/OIu7ik364gn4vYJkzrhyzz79bSxPK NYh6Qhdan1rJ1OSkbQMM5NAGpQRq2so4D2VIkOBF5ceO07sLa3/LB4pFjJoalFdr5E dUMungLQ8J9Lg6GhWOz0VJ5HKc0wd5jLtx+ifdxI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thinh Nguyen , Jerome Brunet , Sasha Levin Subject: [PATCH 4.19 19/33] usb: gadget: u_audio: fix race condition on endpoint stop Date: Wed, 1 Sep 2021 14:28:08 +0200 Message-Id: <20210901122251.421638380@linuxfoundation.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20210901122250.752620302@linuxfoundation.org> References: <20210901122250.752620302@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jerome Brunet [ Upstream commit 068fdad20454f815e61e6f6eb9f051a8b3120e88 ] If the endpoint completion callback is call right after the ep_enabled flag is cleared and before usb_ep_dequeue() is call, we could do a double free on the request and the associated buffer. Fix this by clearing ep_enabled after all the endpoint requests have been dequeued. Fixes: 7de8681be2cd ("usb: gadget: u_audio: Free requests only after callback") Cc: stable Reported-by: Thinh Nguyen Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20210827092927.366482-1-jbrunet@baylibre.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/usb/gadget/function/u_audio.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.30.2 diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c index 0cb0c638fd13..168303f21bf4 100644 --- a/drivers/usb/gadget/function/u_audio.c +++ b/drivers/usb/gadget/function/u_audio.c @@ -349,8 +349,6 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) if (!prm->ep_enabled) return; - prm->ep_enabled = false; - audio_dev = uac->audio_dev; params = &audio_dev->params; @@ -368,11 +366,12 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) } } + prm->ep_enabled = false; + if (usb_ep_disable(ep)) dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__); } - int u_audio_start_capture(struct g_audio *audio_dev) { struct snd_uac_chip *uac = audio_dev->uac;