Re: [PATCH 1/2] usb: gadget: composite: Race between disconnect/unbind and setup

[Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>]

On Sun, 8 Jul 2012, Kevin Cernekee wrote:

> usb_gadget_remove_driver() runs through a four-step sequence to shut down
> the gadget driver.  For the case of a composite gadget + at91 UDC, this
> would look like:
> 
>     udc->driver->disconnect(udc->gadget);          // composite_disconnect()
>     usb_gadget_disconnect(udc->gadget);            // at91_pullup(gadget, 0)
>     udc->driver->unbind(udc->gadget);              // composite_unbind()
>     usb_gadget_udc_stop(udc->gadget, udc->driver); // at91_stop()
> 
> composite_disconnect() says:
> 
>     if (cdev->config)
>         reset_config(cdev);
> 
> reset_config() sets cdev->config to NULL.  composite_unbind() later tests
> for this:
> 
>     WARN_ON(cdev->config);
> 
> But SETUP packets may be sent to the composite driver up until the point
> when usb_gadget_disconnect() returns.

That doesn't sound right.  A host can't send SETUP packets to a 
disconnected port.  The packets should stop arriving when 
udc->driver->disconnect returns -- assuming the UDC driver implements 
a disconnect method.

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html