From d4d45536aee4b02ee7872381eee3ec9b8b78858a Mon Sep 17 00:00:00 2001 From: Vijayavardhan Vennapusa Date: Thu, 18 Aug 2016 11:57:18 +0530 Subject: usb: gadget: composite: Add spinlock protection for usb config descriptor During composition switch, android driver stops data transfers first and removes configuration before disabling pullup for USB3 controller. With this sequence there is a possibility for a race where usb_remove_config is in progress during which pullup is active and sending the setup request for configuration descriptor with zero configuration value. Hence fix the issue by adding spinlock protection for get_config descriptor. CRs-Fixed: 1052608 Change-Id: I65d38387f77addc9a8894a74f427d97313f90a9e Signed-off-by: Vijayavardhan Vennapusa Signed-off-by: Chandana Kishori Chiluveru --- drivers/usb/gadget/composite.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'drivers/usb') diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index a480b0a9a238..98e0caf9fec5 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -1655,7 +1655,9 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) if (!gadget_is_dualspeed(gadget) || gadget->speed >= USB_SPEED_SUPER) break; + spin_lock(&cdev->lock); device_qual(cdev); + spin_unlock(&cdev->lock); value = min_t(int, w_length, sizeof(struct usb_qualifier_descriptor)); break; @@ -1665,7 +1667,9 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) break; /* FALLTHROUGH */ case USB_DT_CONFIG: + spin_lock(&cdev->lock); value = config_desc(cdev, w_value); + spin_unlock(&cdev->lock); if (value >= 0) value = min(w_length, (u16) value); break; -- cgit v1.2.3