From: Chao Bi Date: Mon, 14 Apr 2014 03:19:53 +0000 (+0800) Subject: usb: gadget: ffs: race between ffs_epfile_io() and ffs_func_eps_disable() X-Git-Tag: omap-for-v3.16/soc-signed~13^2~20^2~4 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=97839ca4b06ab27790700ad7da6be9a75fc0cc1d;p=pandora-kernel.git usb: gadget: ffs: race between ffs_epfile_io() and ffs_func_eps_disable() ffs_epfile_io() is called from userspace, while ffs_func_eps_disable() might be called from USB disconnect interrupt, the two functions would run in parallel but they are not well protected, that epfile->ep would be removed by ffs_func_eps_disable() during ffs_epfile_io() is referring this pointer, then it leads to kernel PANIC. The scenario is as below: Thread 1 Thread 2 | | SyS_read dwc3_gadget_disconnect_interrupt | | ffs_epfile_read reset_config | | ffs_epfile_io ffs_func_eps_disable | | ----- usb_ep_disable(): epfile->ep->ep->desc = NULL | | usb_ep_align_maybe(): ----- it refers ep->desc->wMaxPacketSize ----- Signed-off-by: Chao Bi Signed-off-by: Felipe Balbi --- Reading git-diff-tree failed