]>
Commit | Line | Data |
---|---|---|
77a41081 GKH |
1 | From 511f3c5326eabe1ece35202a404c24c0aeacc246 Mon Sep 17 00:00:00 2001 |
2 | From: Alan Stern <stern@rowland.harvard.edu> | |
3 | Date: Fri, 15 Mar 2013 14:02:14 -0400 | |
4 | Subject: usb: gadget: udc-core: fix a regression during gadget driver unbinding | |
5 | ||
6 | From: Alan Stern <stern@rowland.harvard.edu> | |
7 | ||
8 | commit 511f3c5326eabe1ece35202a404c24c0aeacc246 upstream. | |
9 | ||
10 | This patch (as1666) fixes a regression in the UDC core. The core | |
11 | takes care of unbinding gadget drivers, and it does the unbinding | |
12 | before telling the UDC driver to turn off the controller hardware. | |
13 | When the call to the udc_stop callback is made, the gadget no longer | |
14 | has a driver. The callback routine should not be invoked with a | |
15 | pointer to the old driver; doing so can cause problems (such as | |
16 | use-after-free accesses in net2280). | |
17 | ||
18 | This patch should be applied, with appropriate context changes, to all | |
19 | the stable kernels going back to 3.1. | |
20 | ||
21 | Signed-off-by: Alan Stern <stern@rowland.harvard.edu> | |
22 | Signed-off-by: Felipe Balbi <balbi@ti.com> | |
23 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
24 | ||
25 | ||
26 | --- | |
27 | drivers/usb/gadget/udc-core.c | 2 +- | |
28 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
29 | ||
30 | --- a/drivers/usb/gadget/udc-core.c | |
31 | +++ b/drivers/usb/gadget/udc-core.c | |
32 | @@ -265,7 +265,7 @@ static void usb_gadget_remove_driver(str | |
33 | udc->driver->disconnect(udc->gadget); | |
34 | usb_gadget_disconnect(udc->gadget); | |
35 | udc->driver->unbind(udc->gadget); | |
36 | - usb_gadget_udc_stop(udc->gadget, udc->driver); | |
37 | + usb_gadget_udc_stop(udc->gadget, NULL); | |
38 | } else { | |
39 | usb_gadget_stop(udc->gadget, udc->driver); | |
40 | } |