usb: dwc3: gadget: WARN() on bogus usb_ep_queue() (73359cef) · Commits · 戴 / test

Some gadget/function drivers might want to do improper request recycling by allocating a single request from one particular endpoint and queueing it to another completely unrelated endpoint. One such case was found with f_loopback.c. To prevent such cases from happening again, let's WARN() so we get a loud enough failure and persuade users to report errors. Signed-off-by:

Felipe Balbi <balbi@ti.com>

drivers/usb/dwc3/gadget.c

+10 −2

Original line number	Diff line number	Diff line
		@@ -1140,8 +1140,14 @@ static int dwc3_gadget_ep_queue(struct usb_ep ep, struct usb_request request,
		if (!dep->endpoint.desc) {
		dev_dbg(dwc->dev, "trying to queue request %p to disabled %s\n",
		request, ep->name);
		spin_unlock_irqrestore(&dwc->lock, flags);
		return -ESHUTDOWN;
		ret = -ESHUTDOWN;
		goto out;
		}

		if (WARN(req->dep != dep, "request %p belongs to '%s'\n",
		request, req->dep->name)) {
		ret = -EINVAL;
		goto out;
		}

		dev_vdbg(dwc->dev, "queing request %p to %s length %d\n",
		@@ -1149,6 +1155,8 @@ static int dwc3_gadget_ep_queue(struct usb_ep ep, struct usb_request request,
		trace_dwc3_ep_queue(req);

		ret = __dwc3_gadget_ep_queue(dep, req);

		out:
		spin_unlock_irqrestore(&dwc->lock, flags);

		return ret;

Admin message