usb: gadget: u_audio: Free requests only after callback
As per the kernel doc for usb_ep_dequeue(), it states that "this routine is asynchronous, that is, it may return before the completion routine runs". And indeed since v5.0 the dwc3 gadget driver updated its behavior to place dequeued requests on to a cancelled list to be given back later after the endpoint is stopped. The free_ep() was incorrectly assuming that a request was ready to be freed after calling dequeue which results in a use-after-free in dwc3 when it traverses its cancelled list. Fix this by moving the usb_ep_free_request() call to the callback itself in case the ep is disabled. Fixes: eb9fecb9 ("usb: gadget: f_uac2: split out audio core") Reported-and-tested-by:Ferry Toth <fntoth@gmail.com> Reviewed-and-tested-by:
Peter Chen <peter.chen@nxp.com> Acked-by:
Felipe Balbi <balbi@kernel.org> Signed-off-by:
Jack Pham <jackp@codeaurora.org> Signed-off-by:
Jerome Brunet <jbrunet@baylibre.com> Link: https://lore.kernel.org/r/20210118084642.322510-2-jbrunet@baylibre.com Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
7bf0fc5a
Please register or sign in to comment