提交 be0a8887 编写于 作者: L Li Jun 提交者: Felipe Balbi

usb: gadget: composite: dequeue cdev->req before free its buffer

commit f2267089(usb: gadget: composite: dequeue cdev->req before free it in
composite_dev_cleanup) fixed a bug: free the usb request(i.e. cdev->req) but
does not dequeue it beforehand. This fix is not proper enough because it
dequeues the request after free its data buffer, considering the hardware can
access the buffer's memory anytime before the request's complettion rountine
runs, and usb_ep_dequeue always call the complettion rountine before it returns,
so the best way is to dequeue the request before free its buffer.
Suggested-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NLi Jun <b47624@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>
上级 d3102a5e
...@@ -1955,8 +1955,8 @@ void composite_dev_cleanup(struct usb_composite_dev *cdev) ...@@ -1955,8 +1955,8 @@ void composite_dev_cleanup(struct usb_composite_dev *cdev)
usb_ep_free_request(cdev->gadget->ep0, cdev->os_desc_req); usb_ep_free_request(cdev->gadget->ep0, cdev->os_desc_req);
} }
if (cdev->req) { if (cdev->req) {
kfree(cdev->req->buf);
usb_ep_dequeue(cdev->gadget->ep0, cdev->req); usb_ep_dequeue(cdev->gadget->ep0, cdev->req);
kfree(cdev->req->buf);
usb_ep_free_request(cdev->gadget->ep0, cdev->req); usb_ep_free_request(cdev->gadget->ep0, cdev->req);
} }
cdev->next_string_id = 0; cdev->next_string_id = 0;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册