diff options
| author | Benoit Goby <benoit@android.com> | 2011-11-29 13:49:27 -0800 |
|---|---|---|
| committer | Dan Murphy <dmurphy@ti.com> | 2011-12-01 11:35:27 -0600 |
| commit | 114d0e1a59e59fbe15f90d239a4ce7d160329d59 (patch) | |
| tree | 82b3b9328bc2cb2cfb2c7e8a3d4fbe74427bc271 /drivers/usb/gadget | |
| parent | c89bf93a94a74fc13d94e2c91a69de606efd14fe (diff) | |
| download | kernel_samsung_espresso10-114d0e1a59e59fbe15f90d239a4ce7d160329d59.zip kernel_samsung_espresso10-114d0e1a59e59fbe15f90d239a4ce7d160329d59.tar.gz kernel_samsung_espresso10-114d0e1a59e59fbe15f90d239a4ce7d160329d59.tar.bz2 | |
usb: gadget: android: Cancel pending ctrlrequest before disabling
Make sure there is no pending ctrlrequest before removing the config.
Otherwise the ctrlrequest complete callback could access structures
after they have been freed. Unbind cancels pending transfers but not
ep0 requests.
Bug: 5513065 5440193
Change-Id: I063c22bf5d104a3d2df71cf622409459fac5f27a
Signed-off-by: Benoit Goby <benoit@android.com>
Diffstat (limited to 'drivers/usb/gadget')
| -rw-r--r-- | drivers/usb/gadget/android.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/usb/gadget/android.c b/drivers/usb/gadget/android.c index 0258b70..43a5017 100644 --- a/drivers/usb/gadget/android.c +++ b/drivers/usb/gadget/android.c @@ -837,6 +837,8 @@ static ssize_t enable_store(struct device *pdev, struct device_attribute *attr, dev->enabled = true; } else if (!enabled && dev->enabled) { usb_gadget_disconnect(cdev->gadget); + /* Cancel pending control requests */ + usb_ep_dequeue(cdev->gadget->ep0, cdev->req); usb_remove_config(cdev, &android_config_driver); dev->enabled = false; } else { |