Re: [PATCH] usb: gadget: f_uac2: fixup feedback endpoint stop

[Felipe Balbi]

Hi,

Jerome Brunet <jbrunet@xxxxxxxxxxxx> writes:

> When the uac2 function is stopped, there seems to be an issue reported on
> some platforms (Intel Merrifield at least)
>
> BUG: kernel NULL pointer dereference, address: 0000000000000008
> ...
> RIP: 0010:dwc3_gadget_del_and_unmap_request+0x19/0xe0
> ...
> Call Trace:
>  dwc3_remove_requests.constprop.0+0x12f/0x170
>  __dwc3_gadget_ep_disable+0x7a/0x160
>  dwc3_gadget_ep_disable+0x3d/0xd0
>  usb_ep_disable+0x1c/0x70
>  u_audio_stop_capture+0x79/0x120 [u_audio]
>  afunc_set_alt+0x73/0x80 [usb_f_uac2]
>  composite_setup+0x224/0x1b90 [libcomposite]
>
> The issue happens only when the gadget is using the sync type "async", not
> "adaptive". This indicates that problem is coming from the feedback
> endpoint, which is only used with async synchronization mode.
>
> The problem is that request is freed regardless of usb_ep_dequeue(), which
> ends up badly if the request is not actually dequeued yet.
>
> Update the feedback endpoint free function to release the endpoint the same
> way it is done for the data endpoint, which takes care of the problem.
>
> Reported-by: Ferry Toth <ftoth@xxxxxxxxxxxxxx>
> Tested-by: Ferry Toth <ftoth@xxxxxxxxxxxxxx>
> Signed-off-by: Jerome Brunet <jbrunet@xxxxxxxxxxxx>
> ---
>  Hi Felipe,
>
>  This solves the issue reported here [0] and makes revert [1]
>  unnecessary.

awesome work! Thanks

Acked-by: Felipe Balbi <balbi@xxxxxxxxxx>

-- 
balbi