[v2] usb: dwc3: gadget: WARN() on bogus usb_ep_queue()

Message ID 1414592420-18715-1-git-send-email-balbi@ti.com
State Accepted
Commit 73359cef4fcc322c96019b2a5c1e99b08f3bbb57
Headers show

Commit Message

Felipe Balbi Oct. 29, 2014, 2:20 p.m.
Some gadget/function drivers might want to do
improper request recycling by allocating a single
request from one particular endpoint and queueing
it to another completely unrelated endpoint.

One such case was found with f_loopback.c.

To prevent such cases from happening again, let's
WARN() so we get a loud enough failure and persuade
users to report errors.

Signed-off-by: Felipe Balbi <balbi@ti.com>
 drivers/usb/dwc3/gadget.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)


diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 12f4284..20e4ee9 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1140,8 +1140,14 @@  static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
 	if (!dep->endpoint.desc) {
 		dev_dbg(dwc->dev, "trying to queue request %p to disabled %s\n",
 				request, ep->name);
-		spin_unlock_irqrestore(&dwc->lock, flags);
-		return -ESHUTDOWN;
+		ret = -ESHUTDOWN;
+		goto out;
+	}
+	if (WARN(req->dep != dep, "request %p belongs to '%s'\n",
+				request, req->dep->name)) {
+		ret = -EINVAL;
+		goto out;
 	dev_vdbg(dwc->dev, "queing request %p to %s length %d\n",
@@ -1149,6 +1155,8 @@  static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
 	ret = __dwc3_gadget_ep_queue(dep, req);
 	spin_unlock_irqrestore(&dwc->lock, flags);
 	return ret;