On Wed, 27 Mar 2013, Felipe Balbi wrote:
> From: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
>
> This patch (as1666) fixes a regression in the UDC core. The core
> takes care of unbinding gadget drivers, and it does the unbinding
> before telling the UDC driver to turn off the controller hardware.
> When the call to the udc_stop callback is made, the gadget no longer
> has a driver. The callback routine should not be invoked with a
> pointer to the old driver; doing so can cause problems (such as
> use-after-free accesses in net2280).
>
> This patch should be applied, with appropriate context changes, to all
> the stable kernels going back to 3.1.
>
> (original mainline commit 511f3c5326eabe1ece35202a404c24c0aeacc246)
>
> Signed-off-by: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
> CC: <stable@xxxxxxxxxxxxxxx> # v3.4
> Signed-off-by: Felipe Balbi <balbi@xxxxxx>
> ---
>
> backported to 3.4.y stable tree. Alan, can you ack if this is the right
> backport ?
>
> drivers/usb/gadget/udc-core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
> index e5e44f8..b0af333 100644
> --- a/drivers/usb/gadget/udc-core.c
> +++ b/drivers/usb/gadget/udc-core.c
> @@ -265,7 +265,7 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
> udc->driver->disconnect(udc->gadget);
> usb_gadget_disconnect(udc->gadget);
> udc->driver->unbind(udc->gadget);
> - usb_gadget_udc_stop(udc->gadget, udc->driver);
> + usb_gadget_udc_stop(udc->gadget, NULL);
> } else {
> usb_gadget_stop(udc->gadget, udc->driver);
> }
> backported to v3.8.y stable tree. Alan, can ack if this is the right
> backport ?
>
> drivers/usb/gadget/udc-core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
> index 4d90a80..34a3907 100644
> --- a/drivers/usb/gadget/udc-core.c
> +++ b/drivers/usb/gadget/udc-core.c
> @@ -265,7 +265,7 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
> usb_gadget_disconnect(udc->gadget);
> udc->driver->disconnect(udc->gadget);
> udc->driver->unbind(udc->gadget);
> - usb_gadget_udc_stop(udc->gadget, udc->driver);
> + usb_gadget_udc_stop(udc->gadget, NULL);
> } else {
> usb_gadget_stop(udc->gadget, udc->driver);
> }
Yes, these are both correct. Thanks for taking care of this.
Alan Stern
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html