If a file descriptor to /dev/hidgN is kept open after the gadget function has been deleted, reading or writing will block indefinitely since no requests will ever be processed. Add a flag to note that the function has been deleted and check this in read & write if there is no other action to take. When setting this flag, also wake up any readers/writers so that they get ENODEV immediately. Signed-off-by: John Keeping <john@xxxxxxxxxxxx> --- v2: - No changes drivers/usb/gadget/function/f_hid.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c index 3d848f7a4cca..a65bdf08ca54 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -59,6 +59,7 @@ struct f_hidg { struct usb_request *req; struct kref kref; + bool deleted; int minor; struct usb_function func; @@ -271,10 +272,14 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer, /* wait for at least one buffer to complete */ while (!READ_COND) { spin_unlock_irqrestore(&hidg->read_spinlock, flags); + if (READ_ONCE(hidg->deleted)) + return -ENODEV; + if (file->f_flags & O_NONBLOCK) return -EAGAIN; - if (wait_event_interruptible(hidg->read_queue, READ_COND)) + if (wait_event_interruptible(hidg->read_queue, + READ_COND || READ_ONCE(hidg->deleted))) return -ERESTARTSYS; spin_lock_irqsave(&hidg->read_spinlock, flags); @@ -358,11 +363,14 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, /* write queue */ while (!WRITE_COND) { spin_unlock_irqrestore(&hidg->write_spinlock, flags); + if (READ_ONCE(hidg->deleted)) + return -ENODEV; + if (file->f_flags & O_NONBLOCK) return -EAGAIN; - if (wait_event_interruptible_exclusive( - hidg->write_queue, WRITE_COND)) + if (wait_event_interruptible_exclusive(hidg->write_queue, + WRITE_COND || READ_ONCE(hidg->deleted))) return -ERESTARTSYS; spin_lock_irqsave(&hidg->write_spinlock, flags); @@ -1070,6 +1078,10 @@ static void hidg_free(struct usb_function *f) hidg = func_to_hidg(f); opts = container_of(f->fi, struct f_hid_opts, func_inst); + WRITE_ONCE(hidg->deleted, true); + wake_up(&hidg->read_queue); + wake_up(&hidg->write_queue); + kref_put(&hidg->kref, hidg_release); mutex_lock(&opts->lock); --opts->refcnt; -- 2.23.0