mirror of
https://github.com/torvalds/linux.git
synced 2024-12-01 16:41:39 +00:00
61a348857e
In current scenario if Plug-out and Plug-In performed continuously
there could be a chance while checking for dwc->gadget_driver in
dwc3_gadget_suspend, a NULL pointer dereference may occur.
Call Stack:
CPU1: CPU2:
gadget_unbind_driver dwc3_suspend_common
dwc3_gadget_stop dwc3_gadget_suspend
dwc3_disconnect_gadget
CPU1 basically clears the variable and CPU2 checks the variable.
Consider CPU1 is running and right before gadget_driver is cleared
and in parallel CPU2 executes dwc3_gadget_suspend where it finds
dwc->gadget_driver which is not NULL and resumes execution and then
CPU1 completes execution. CPU2 executes dwc3_disconnect_gadget where
it checks dwc->gadget_driver is already NULL because of which the
NULL pointer deference occur.
Cc: stable@vger.kernel.org
Fixes:
|
||
|---|---|---|
| .. | ||
| core.c | ||
| core.h | ||
| debug.h | ||
| debugfs.c | ||
| drd.c | ||
| dwc3-am62.c | ||
| dwc3-exynos.c | ||
| dwc3-haps.c | ||
| dwc3-imx8mp.c | ||
| dwc3-keystone.c | ||
| dwc3-meson-g12a.c | ||
| dwc3-octeon.c | ||
| dwc3-of-simple.c | ||
| dwc3-omap.c | ||
| dwc3-pci.c | ||
| dwc3-qcom.c | ||
| dwc3-rtk.c | ||
| dwc3-st.c | ||
| dwc3-xilinx.c | ||
| ep0.c | ||
| gadget.c | ||
| gadget.h | ||
| host.c | ||
| io.h | ||
| Kconfig | ||
| Makefile | ||
| trace.c | ||
| trace.h | ||
| ulpi.c | ||