]> git.itanic.dy.fi Git - linux-stable/commit
usb: musb: Get the musb_qh poniter after musb_giveback
authorXingxing Luo <xingxing.luo@unisoc.com>
Tue, 19 Sep 2023 03:30:55 +0000 (11:30 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 25 Oct 2023 09:16:29 +0000 (11:16 +0200)
commit04bafe15b7f21701e1af5372da6aa0b97c3a8a90
tree0723dd9e34fab426460d84a4c9a1011ce6876783
parent2966f373a3af5c5878bae54d4ce81d06557e624b
usb: musb: Get the musb_qh poniter after musb_giveback

commit 33d7e37232155aadebe4145dcc592f00dabd7a2b upstream.

When multiple threads are performing USB transmission, musb->lock will be
unlocked when musb_giveback is executed. At this time, qh may be released
in the dequeue process in other threads, resulting in a wild pointer, so
it needs to be here get qh again, and judge whether qh is NULL, and when
dequeue, you need to set qh to NULL.

Fixes: dbac5d07d13e ("usb: musb: host: don't start next rx urb if current one failed")
Cc: stable@vger.kernel.org
Signed-off-by: Xingxing Luo <xingxing.luo@unisoc.com>
Link: https://lore.kernel.org/r/20230919033055.14085-1-xingxing.luo@unisoc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/musb/musb_host.c