Hi, Jerome Brunet <jbrunet@xxxxxxxxxxxx> writes: > When the uac2 function is stopped, there seems to be an issue reported on > some platforms (Intel Merrifield at least) > > BUG: kernel NULL pointer dereference, address: 0000000000000008 > ... > RIP: 0010:dwc3_gadget_del_and_unmap_request+0x19/0xe0 > ... > Call Trace: > dwc3_remove_requests.constprop.0+0x12f/0x170 > __dwc3_gadget_ep_disable+0x7a/0x160 > dwc3_gadget_ep_disable+0x3d/0xd0 > usb_ep_disable+0x1c/0x70 > u_audio_stop_capture+0x79/0x120 [u_audio] > afunc_set_alt+0x73/0x80 [usb_f_uac2] > composite_setup+0x224/0x1b90 [libcomposite] > > The issue happens only when the gadget is using the sync type "async", not > "adaptive". This indicates that problem is coming from the feedback > endpoint, which is only used with async synchronization mode. > > The problem is that request is freed regardless of usb_ep_dequeue(), which > ends up badly if the request is not actually dequeued yet. > > Update the feedback endpoint free function to release the endpoint the same > way it is done for the data endpoint, which takes care of the problem. > > Reported-by: Ferry Toth <ftoth@xxxxxxxxxxxxxx> > Tested-by: Ferry Toth <ftoth@xxxxxxxxxxxxxx> > Signed-off-by: Jerome Brunet <jbrunet@xxxxxxxxxxxx> > --- > Hi Felipe, > > This solves the issue reported here [0] and makes revert [1] > unnecessary. awesome work! Thanks Acked-by: Felipe Balbi <balbi@xxxxxxxxxx> -- balbi
