On Sun, Sep 19, 2021 at 09:41:27PM +0200, Florian Faber wrote:
> In usb_composite_setup_continue, req->complete is not set, leaving the
> previous value untouched. After completion of the ep0 transaction, the UDC
> would then call whatever complete callback is set with the composite cdev as
> context, leading to all sorts of havoc.
>
> Signed-off-by: Florian Faber <faber@xxxxxxxxxxx>
>
> ---
> drivers/usb/gadget/composite.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
> index 504c1cbc255d..8d497be4be32 100644
> --- a/drivers/usb/gadget/composite.c
> +++ b/drivers/usb/gadget/composite.c
> @@ -2518,6 +2518,7 @@ void usb_composite_setup_continue(struct
> usb_composite_dev *cdev)
> DBG(cdev, "%s: Completing delayed status\n", __func__);
> req->length = 0;
> req->context = cdev;
> + req->complete = composite_setup_complete;
> value = composite_ep0_queue(cdev, req, GFP_ATOMIC);
> if (value < 0) {
> DBG(cdev, "ep_queue --> %d\n", value);
> --
Is this a bugfix? If so, what commit does this fix?
How can you trigger this issue?
And your patch is line-wrapped and can not be applied :(
thanks,
greg k-h
