During urb_enqueue, if the urb can't be queued to the endpoint,
the urb is freed without any spinlock protection.
This leads to memory corruption when concurrent urb_dequeue try to free
same urb->hcpriv.
Thus, ensure the whole urb_enqueue in spinlocked.
Acked-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Gregory Herrero <gregory.herrero@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
writel(0, hsotg->regs + HPRT0);
}
writel(0, hsotg->regs + HPRT0);
}
+/* Caller must hold driver lock */
static int dwc2_hcd_urb_enqueue(struct dwc2_hsotg *hsotg,
struct dwc2_hcd_urb *urb, void **ep_handle,
gfp_t mem_flags)
{
struct dwc2_qtd *qtd;
static int dwc2_hcd_urb_enqueue(struct dwc2_hsotg *hsotg,
struct dwc2_hcd_urb *urb, void **ep_handle,
gfp_t mem_flags)
{
struct dwc2_qtd *qtd;
u32 intr_mask;
int retval;
int dev_speed;
u32 intr_mask;
int retval;
int dev_speed;
- spin_lock_irqsave(&hsotg->lock, flags);
tr_type = dwc2_hcd_select_transactions(hsotg);
if (tr_type != DWC2_TRANSACTION_NONE)
dwc2_hcd_queue_transactions(hsotg, tr_type);
tr_type = dwc2_hcd_select_transactions(hsotg);
if (tr_type != DWC2_TRANSACTION_NONE)
dwc2_hcd_queue_transactions(hsotg, tr_type);
- spin_unlock_irqrestore(&hsotg->lock, flags);
"%s: unaligned transfer with no transfer_buffer",
__func__);
retval = -EINVAL;
"%s: unaligned transfer with no transfer_buffer",
__func__);
retval = -EINVAL;
spin_lock_irqsave(&hsotg->lock, flags);
retval = usb_hcd_link_urb_to_ep(hcd, urb);
spin_lock_irqsave(&hsotg->lock, flags);
retval = usb_hcd_link_urb_to_ep(hcd, urb);
- spin_unlock_irqrestore(&hsotg->lock, flags);
goto fail2;
if (alloc_bandwidth) {
goto fail2;
if (alloc_bandwidth) {
- spin_lock_irqsave(&hsotg->lock, flags);
dwc2_allocate_bus_bandwidth(hcd,
dwc2_hcd_get_ep_bandwidth(hsotg, ep),
urb);
dwc2_allocate_bus_bandwidth(hcd,
dwc2_hcd_get_ep_bandwidth(hsotg, ep),
urb);
- spin_unlock_irqrestore(&hsotg->lock, flags);
+ spin_unlock_irqrestore(&hsotg->lock, flags);
+
- spin_lock_irqsave(&hsotg->lock, flags);
dwc2_urb->priv = NULL;
usb_hcd_unlink_urb_from_ep(hcd, urb);
dwc2_urb->priv = NULL;
usb_hcd_unlink_urb_from_ep(hcd, urb);
- spin_unlock_irqrestore(&hsotg->lock, flags);
+ spin_unlock_irqrestore(&hsotg->lock, flags);
kfree(dwc2_urb);
return retval;
kfree(dwc2_urb);
return retval;
/**
* dwc2_hcd_qtd_add() - Adds a QTD to the QTD-list of a QH
/**
* dwc2_hcd_qtd_add() - Adds a QTD to the QTD-list of a QH
+ * Caller must hold driver lock.
*
* @hsotg: The DWC HCD structure
* @qtd: The QTD to add
*
* @hsotg: The DWC HCD structure
* @qtd: The QTD to add
struct dwc2_qh **qh, gfp_t mem_flags)
{
struct dwc2_hcd_urb *urb = qtd->urb;
struct dwc2_qh **qh, gfp_t mem_flags)
{
struct dwc2_hcd_urb *urb = qtd->urb;
int allocated = 0;
int retval;
int allocated = 0;
int retval;
- spin_lock_irqsave(&hsotg->lock, flags);
-
retval = dwc2_hcd_qh_add(hsotg, *qh);
if (retval)
goto fail;
qtd->qh = *qh;
list_add_tail(&qtd->qtd_list_entry, &(*qh)->qtd_list);
retval = dwc2_hcd_qh_add(hsotg, *qh);
if (retval)
goto fail;
qtd->qh = *qh;
list_add_tail(&qtd->qtd_list_entry, &(*qh)->qtd_list);
- spin_unlock_irqrestore(&hsotg->lock, flags);
qtd_list_entry)
dwc2_hcd_qtd_unlink_and_free(hsotg, qtd2, qh_tmp);
qtd_list_entry)
dwc2_hcd_qtd_unlink_and_free(hsotg, qtd2, qh_tmp);
- spin_unlock_irqrestore(&hsotg->lock, flags);
dwc2_hcd_qh_free(hsotg, qh_tmp);
dwc2_hcd_qh_free(hsotg, qh_tmp);
- } else {
- spin_unlock_irqrestore(&hsotg->lock, flags);