summaryrefslogtreecommitdiff
path: root/drivers/usb/gadget
diff options
context:
space:
mode:
authorDu, Changbin <changbin.du@intel.com>2015-12-18 10:36:40 +0300
committerFelipe Balbi <balbi@ti.com>2015-12-22 21:04:05 +0300
commit8a0859b65b06ea07461271ce4f1fe25b48d1ec55 (patch)
treebc345d9e4aadb539983ea114dacbf11cdfd9de35 /drivers/usb/gadget
parent6d76c92c2fcbee4fd1f6d7b375d71057c7a615b1 (diff)
downloadlinux-8a0859b65b06ea07461271ce4f1fe25b48d1ec55.tar.xz
usb: gadget: forbid queuing request to a disabled ep
Queue a request to disabled ep doesn't make sense, and induce caller make mistakes. Here is a example for the android mtp gadget function driver. A mem corruption can happen on below senario. 1) On disconnect, mtp driver disable its EPs, 2) During send_file_work and receive_file_work, mtp queues a request to ep. (The mtp driver need improve its synchronization logic!) 3) mtp_function_unbind is invoked and all mtp requests are freed. 4) when udc process the request queued on step 2, will cause kernel NULL pointer dereference exception. Signed-off-by: Du, Changbin <changbin.du@intel.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
Diffstat (limited to 'drivers/usb/gadget')
0 files changed, 0 insertions, 0 deletions