diff options
| author | Marcus Nutzinger <marcus.nutzinger@theobroma-systems.com> | 2014-06-05 17:17:06 +0200 |
|---|---|---|
| committer | Felipe Balbi <balbi@ti.com> | 2014-06-19 10:11:14 -0500 |
| commit | f0cae93f3f7e9a26c2d6bc182204c37dec3698eb (patch) | |
| tree | ec58317828c265211d09b214e666c36b8b53075c /drivers/usb | |
| parent | 14574b546d87a282cc9ea0f43935cee6bfc97bf8 (diff) | |
usb: gadget: gadgetfs: correct dev state
This reverts commit 1826e9b1 (usb: gadget: gadgetfs: use
after free in dev_release()) and places the call to
put_dev() after setting the state.
If this is not the final call to dev_release() and the
state is not reset to STATE_DEV_DISABLED and hence all
further open() calls to the gadgetfs ep0 device will
fail with EBUSY.
Signed-off-by: Marcus Nutzinger <marcus.nutzinger@theobroma-systems.com>
Reviewed-by: Christoph Muellner <christoph.muellner@theobroma-systems.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/gadget/inode.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c index ee6c16416c3..2e4ce770490 100644 --- a/drivers/usb/gadget/inode.c +++ b/drivers/usb/gadget/inode.c @@ -1264,8 +1264,13 @@ dev_release (struct inode *inode, struct file *fd) kfree (dev->buf); dev->buf = NULL; - put_dev (dev); + /* other endpoints were all decoupled from this device */ + spin_lock_irq(&dev->lock); + dev->state = STATE_DEV_DISABLED; + spin_unlock_irq(&dev->lock); + + put_dev (dev); return 0; } |