usb: gadget: core: Fix use-after-free of usb_request

[mirror_ubuntu-bionic-kernel.git] / drivers / usb / gadget / udc / core.c

diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 1b3efb14aec7878e616a3a1a7588046e2641aec7..07146a37bde67f447933d0149d7807f196d5828e 100644 (file)
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -180,8 +180,8 @@ EXPORT_SYMBOL_GPL(usb_ep_alloc_request);
 void usb_ep_free_request(struct usb_ep *ep,
                                       struct usb_request *req)
 {
-       ep->ops->free_request(ep, req);
        trace_usb_ep_free_request(ep, req, 0);
+       ep->ops->free_request(ep, req);
 }
 EXPORT_SYMBOL_GPL(usb_ep_free_request);
 
@@ -238,6 +238,9 @@ EXPORT_SYMBOL_GPL(usb_ep_free_request);
  * arranges to poll once per interval, and the gadget driver usually will
  * have queued some data to transfer at that time.
  *
+ * Note that @req's ->complete() callback must never be called from
+ * within usb_ep_queue() as that can create deadlock situations.
+ *
  * Returns zero, or a negative error code.  Endpoints that are not enabled
  * report errors; errors will also be
  * reported when the usb peripheral is disconnected.
@@ -912,7 +915,7 @@ int usb_gadget_ep_match_desc(struct usb_gadget *gadget,
                return 0;
 
        /* "high bandwidth" works only at high speed */
-       if (!gadget_is_dualspeed(gadget) && usb_endpoint_maxp(desc) & (3<<11))
+       if (!gadget_is_dualspeed(gadget) && usb_endpoint_maxp_mult(desc) > 1)
                return 0;
 
        switch (type) {