mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2025-12-26 20:27:20 +00:00
6fc1db5e62
During unbind, ffs_func_eps_disable() will be executed, resulting in completion callbacks for any pending USB requests. When using AIO, irrespective of the completion status, io_data work is queued to io_completion_wq to evaluate and handle the completed requests. Since work runs asynchronously to the unbind() routine, there can be a scenario where the work runs after the USB gadget has been fully removed, resulting in accessing of a resource which has been already freed. (i.e. usb_ep_free_request() accessing the USB ep structure) Explicitly drain the io_completion_wq, instead of relying on the destroy_workqueue() (in ffs_data_put()) to make sure no pending completion work items are running. Signed-off-by: Wesley Cheng <wcheng@codeaurora.org> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/1621644261-1236-1-git-send-email-wcheng@codeaurora.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| f_acm.c | ||
| f_ecm.c | ||
| f_eem.c | ||
| f_fs.c | ||
| f_hid.c | ||
| f_loopback.c | ||
| f_mass_storage.c | ||
| f_mass_storage.h | ||
| f_midi.c | ||
| f_ncm.c | ||
| f_obex.c | ||
| f_phonet.c | ||
| f_printer.c | ||
| f_rndis.c | ||
| f_serial.c | ||
| f_sourcesink.c | ||
| f_subset.c | ||
| f_tcm.c | ||
| f_uac1_legacy.c | ||
| f_uac1.c | ||
| f_uac2.c | ||
| f_uvc.c | ||
| f_uvc.h | ||
| g_zero.h | ||
| Makefile | ||
| ndis.h | ||
| rndis.c | ||
| rndis.h | ||
| storage_common.c | ||
| storage_common.h | ||
| tcm.h | ||
| u_audio.c | ||
| u_audio.h | ||
| u_ecm.h | ||
| u_eem.h | ||
| u_ether_configfs.h | ||
| u_ether.c | ||
| u_ether.h | ||
| u_fs.h | ||
| u_gether.h | ||
| u_hid.h | ||
| u_midi.h | ||
| u_ncm.h | ||
| u_phonet.h | ||
| u_printer.h | ||
| u_rndis.h | ||
| u_serial.c | ||
| u_serial.h | ||
| u_tcm.h | ||
| u_uac1_legacy.c | ||
| u_uac1_legacy.h | ||
| u_uac1.h | ||
| u_uac2.h | ||
| u_uvc.h | ||
| uvc_configfs.c | ||
| uvc_configfs.h | ||
| uvc_queue.c | ||
| uvc_queue.h | ||
| uvc_v4l2.c | ||
| uvc_v4l2.h | ||
| uvc_video.c | ||
| uvc_video.h | ||
| uvc.h | ||