Commit e752dbc5 authored by Yoshihiro Shimoda's avatar Yoshihiro Shimoda Committed by Greg Kroah-Hartman
Browse files

usb: gadget: udc: renesas_usb3: Fix a race in usb3_start_pipen() 



The usb3_start_pipen() is called by renesas_usb3_ep_queue() and
usb3_request_done_pipen() so that usb3_start_pipen() is possible
to cause a race when getting usb3_first_req like below:

renesas_usb3_ep_queue()
 spin_lock_irqsave()
 list_add_tail()
 spin_unlock_irqrestore()
 usb3_start_pipen()
  usb3_first_req = usb3_get_request() --- [1]
 --- interrupt ---
 usb3_irq_dma_int()
 usb3_request_done_pipen()
  usb3_get_request()
  usb3_start_pipen()
  usb3_first_req = usb3_get_request()
  ...
  (the req is possible to be finished in the interrupt)

The usb3_first_req [1] above may have been finished after the interrupt
ended so that this driver caused to start a transfer wrongly. To fix this
issue, getting/checking the usb3_first_req are under spin_lock_irqsave()
in the same section.

Fixes: 746bfe63 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/20210524060155.1178724-1-yoshihiro.shimoda.uh@renesas.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a20dcf53

drivers/usb/gadget/udc/renesas_usb3.c

+3 −2
Original line number Diff line number Diff line
@@ -1488,7 +1488,7 @@ static void usb3_start_pipen(struct renesas_usb3_ep *usb3_ep, 
			     struct renesas_usb3_request *usb3_req)

{

	struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);

	struct renesas_usb3_request *usb3_req_first = usb3_get_request(usb3_ep);

	struct renesas_usb3_request *usb3_req_first;

	unsigned long flags;

	int ret = -EAGAIN;

	u32 enable_bits = 0;
@@ -1496,7 +1496,8 @@ static void usb3_start_pipen(struct renesas_usb3_ep *usb3_ep, 
	spin_lock_irqsave(&usb3->lock, flags);

	if (usb3_ep->halt || usb3_ep->started)

		goto out;

	if (usb3_req != usb3_req_first)

	usb3_req_first = __usb3_get_request(usb3_ep);

	if (!usb3_req_first || usb3_req != usb3_req_first)

		goto out;



	if (usb3_pn_change(usb3, usb3_ep->num) < 0)