]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
usb: musb: Get the musb_qh poniter after musb_giveback
authorXingxing Luo <xingxing.luo@unisoc.com>
Tue, 19 Sep 2023 03:30:55 +0000 (11:30 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 25 Oct 2023 09:13:30 +0000 (11:13 +0200)
commit9480fa536592dbe3173440ade43d5bc955cb08ed
tree36135f6496b656421b2266afd9c4af5127d03a8e
parentb53b00bf71c6784adb529741dd0010d0abf3f27d
usb: musb: Get the musb_qh poniter after musb_giveback

commit 33d7e37232155aadebe4145dcc592f00dabd7a2b upstream.

When multiple threads are performing USB transmission, musb->lock will be
unlocked when musb_giveback is executed. At this time, qh may be released
in the dequeue process in other threads, resulting in a wild pointer, so
it needs to be here get qh again, and judge whether qh is NULL, and when
dequeue, you need to set qh to NULL.

Fixes: dbac5d07d13e ("usb: musb: host: don't start next rx urb if current one failed")
Cc: stable@vger.kernel.org
Signed-off-by: Xingxing Luo <xingxing.luo@unisoc.com>
Link: https://lore.kernel.org/r/20230919033055.14085-1-xingxing.luo@unisoc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/musb/musb_host.c