mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2026-01-06 20:44:11 +00:00
62c73bfea0
dwc->desired_dr_role is changed by dwc3_set_mode inside a spinlock but
then read by __dwc3_set_mode outside of that lock. This can lead to a
race condition when very quick successive role switch events happen:
CPU A
dwc3_set_mode(DWC3_GCTL_PRTCAP_HOST) // first role switch event
spin_lock_irqsave(&dwc->lock, flags);
dwc->desired_dr_role = mode; // DWC3_GCTL_PRTCAP_HOST
spin_unlock_irqrestore(&dwc->lock, flags);
queue_work(system_freezable_wq, &dwc->drd_work);
CPU B
__dwc3_set_mode
// ....
spin_lock_irqsave(&dwc->lock, flags);
// desired_dr_role is DWC3_GCTL_PRTCAP_HOST
dwc3_set_prtcap(dwc, dwc->desired_dr_role);
spin_unlock_irqrestore(&dwc->lock, flags);
CPU A
dwc3_set_mode(DWC3_GCTL_PRTCAP_DEVICE) // second event
spin_lock_irqsave(&dwc->lock, flags);
dwc->desired_dr_role = mode; // DWC3_GCTL_PRTCAP_DEVICE
spin_unlock_irqrestore(&dwc->lock, flags);
CPU B (continues running __dwc3_set_mode)
switch (dwc->desired_dr_role) { // DWC3_GCTL_PRTCAP_DEVICE
// ....
case DWC3_GCTL_PRTCAP_DEVICE:
// ....
ret = dwc3_gadget_init(dwc);
We then have DWC3_GCTL.DWC3_GCTL_PRTCAPDIR = DWC3_GCTL_PRTCAP_HOST and
dwc->current_dr_role = DWC3_GCTL_PRTCAP_HOST but initialized the
controller in device mode. It's also possible to get into a state
where both host and device are intialized at the same time.
Fix this race by creating a local copy of desired_dr_role inside
__dwc3_set_mode while holding dwc->lock.
Fixes:
|
||
|---|---|---|
| .. | ||
| core.c | ||
| core.h | ||
| debug.h | ||
| debugfs.c | ||
| drd.c | ||
| dwc3-am62.c | ||
| dwc3-exynos.c | ||
| dwc3-haps.c | ||
| dwc3-imx8mp.c | ||
| dwc3-keystone.c | ||
| dwc3-meson-g12a.c | ||
| dwc3-of-simple.c | ||
| dwc3-omap.c | ||
| dwc3-pci.c | ||
| dwc3-qcom.c | ||
| dwc3-st.c | ||
| dwc3-xilinx.c | ||
| ep0.c | ||
| gadget.c | ||
| gadget.h | ||
| host.c | ||
| io.h | ||
| Kconfig | ||
| Makefile | ||
| trace.c | ||
| trace.h | ||
| ulpi.c | ||