diff options
| author | Chao Bi <chao.bi@intel.com> | 2014-04-14 07:19:53 +0400 |
|---|---|---|
| committer | Felipe Balbi <balbi@ti.com> | 2014-04-16 19:11:47 +0400 |
| commit | 97839ca4b06ab27790700ad7da6be9a75fc0cc1d (patch) | |
| tree | 1aad06a0dfb7fd602f3f276bbce68013186ee3e3 /firmware | |
| parent | 9dc9cb0c9ad0f999e29ce4c4f307cd2abbe752d3 (diff) | |
| download | linux-97839ca4b06ab27790700ad7da6be9a75fc0cc1d.tar.xz | |
usb: gadget: ffs: race between ffs_epfile_io() and ffs_func_eps_disable()
ffs_epfile_io() is called from userspace, while ffs_func_eps_disable() might be
called from USB disconnect interrupt, the two functions would run in parallel
but they are not well protected, that epfile->ep would be removed by
ffs_func_eps_disable() during ffs_epfile_io() is referring this pointer, then
it leads to kernel PANIC.
The scenario is as below:
Thread 1 Thread 2
| |
SyS_read dwc3_gadget_disconnect_interrupt
| |
ffs_epfile_read reset_config
| |
ffs_epfile_io ffs_func_eps_disable
| |
----- usb_ep_disable(): epfile->ep->ep->desc = NULL
| |
usb_ep_align_maybe(): -----
it refers ep->desc->wMaxPacketSize -----
Signed-off-by: Chao Bi <chao.bi@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Diffstat (limited to 'firmware')
0 files changed, 0 insertions, 0 deletions