Commit 2e8ca86b authored by Thinh Nguyen's avatar Thinh Nguyen Committed by sanglipeng
Browse files

usb: dwc3: gadget: Clear ep descriptor last 

stable inclusion
from stable-v5.10.157
commit f06b7e6a77c177d30fe3e2d64ccc02daf59b51f8
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f06b7e6a77c177d30fe3e2d64ccc02daf59b51f8



--------------------------------

[ Upstream commit f90f5afd ]

Until the endpoint is disabled, its descriptors should remain valid.
When its requests are removed from ep disable, the request completion
routine may attempt to access the endpoint's descriptor. Don't clear the
descriptors before that.

Fixes: f09ddcfc ("usb: dwc3: gadget: Prevent EP queuing while stopping transfers")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarThinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/45db7c83b209259115bf652af210f8b2b3b1a383.1668561364.git.Thinh.Nguyen@synopsys.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
parent cd6fb006

drivers/usb/dwc3/gadget.c

+6 −6
Original line number Diff line number Diff line
@@ -803,18 +803,18 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) 
	reg &= ~DWC3_DALEPENA_EP(dep->number);

	dwc3_writel(dwc->regs, DWC3_DALEPENA, reg);



	/* Clear out the ep descriptors for non-ep0 */

	if (dep->number > 1) {

		dep->endpoint.comp_desc = NULL;

		dep->endpoint.desc = NULL;

	}



	dwc3_remove_requests(dwc, dep, -ESHUTDOWN);



	dep->stream_capable = false;

	dep->type = 0;

	dep->flags = 0;



	/* Clear out the ep descriptors for non-ep0 */

	if (dep->number > 1) {

		dep->endpoint.comp_desc = NULL;

		dep->endpoint.desc = NULL;

	}



	return 0;

}