[lkml]   [2018]   [May]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 4.14 35/43] usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue
4.14-stable review patch.  If anyone has any objections, please let me know.


From: Mayank Rana <>

commit 96bd39df29c29d348d65311e5954c0b7d3a2a790 upstream.

dwc3_ep_dequeue() waits for completion of End Transfer command using
wait_event_lock_irq(), which will release the dwc3->lock while waiting
and reacquire after completion. This allows a potential race condition
with ep_disable() which also removes all requests from started_list
and pending_list.

The check for NULL r->trb should catch this but currently it exits to
the wrong 'out1' label which calls dwc3_gadget_giveback(). Since its
list entry was already removed, if CONFIG_DEBUG_LIST is enabled a
'list_del corruption' bug is thrown since its next/prev pointers are
already LIST_POISON1/2. If r->trb is NULL it should simply exit to

Fixes: cf3113d893d4 ("usb: dwc3: gadget: properly increment dequeue pointer on ep_dequeue")
Cc: # v4.12+
Signed-off-by: Mayank Rana <>
Signed-off-by: Jack Pham <>
Signed-off-by: Felipe Balbi <>
Signed-off-by: Greg Kroah-Hartman <>

drivers/usb/dwc3/gadget.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1444,7 +1444,7 @@ static int dwc3_gadget_ep_dequeue(struct

if (!r->trb)
- goto out1;
+ goto out0;

if (r->num_pending_sgs) {
struct dwc3_trb *trb;

 \ /
  Last update: 2018-05-08 10:32    [W:0.128 / U:0.356 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site