@@ -2293,8 +2293,7 @@ static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
static void fsg_disable(struct usb_function *f)
{
struct fsg_dev *fsg = fsg_from_func(f);
- fsg->common->new_fsg = NULL;
- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+ raise_exception(fsg->common, FSG_STATE_CONFIG_CLEAR);
}
@@ -2412,10 +2411,13 @@ static void handle_exception(struct fsg_common *common)
/* SS_RESET_OCCURRED; */
break;
+ case FSG_STATE_CONFIG_CLEAR:
+ do_set_interface(common, NULL);
+ break;
+
case FSG_STATE_CONFIG_CHANGE:
do_set_interface(common, common->new_fsg);
- if (common->new_fsg)
- usb_composite_setup_continue(common->cdev);
+ usb_composite_setup_continue(common->cdev);
break;
case FSG_STATE_EXIT:
@@ -2989,8 +2991,7 @@ static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
DBG(fsg, "unbind\n");
if (fsg->common->fsg == fsg) {
- fsg->common->new_fsg = NULL;
- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+ raise_exception(fsg->common, FSG_STATE_CONFIG_CLEAR);
/* FIXME: make interruptible or killable somehow? */
wait_event(common->fsg_wait, common->fsg != fsg);
}
@@ -160,6 +160,7 @@ enum fsg_state {
FSG_STATE_NORMAL,
FSG_STATE_ABORT_BULK_OUT,
FSG_STATE_PROTOCOL_RESET,
+ FSG_STATE_CONFIG_CLEAR,
FSG_STATE_CONFIG_CHANGE,
FSG_STATE_EXIT,
FSG_STATE_TERMINATED
If fsg_disable() and fsg_set_alt() are called too closely to each other (for example due to a quick reset/reconnect), what can happen is that fsg_set_alt sets common->new_fsg from an interrupt while handle_exception is trying to process the config change caused by fsg_disable(): fsg_disable() ... handle_exception() sets state back to FSG_STATE_NORMAL hasn't yet called do_set_interface() or is inside it. ---> interrupt fsg_set_alt sets common->new_fsg queues a new FSG_STATE_CONFIG_CHANGE <--- Now, the first handle_exception can "see" the updated new_fsg, treats it as if it was a fsg_set_alt() response, call usb_composite_setup_continue() etc... But then, the thread sees the second FSG_STATE_CONFIG_CHANGE, and goes back down the same path, wipes and reattaches a now active fsg, and .. calls usb_composite_setup_continue() which at this point is wrong. Not only we get a backtrace, but I suspect the second set_interface wrecks some state causing the host to get upset in my case. This fixes it by using a separate state for "clearing" the fsg so that new_fsg isn't clobbered, and FSG_STATE_CONFIG_CHANGE is only ever called for the real thing. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> --- drivers/usb/gadget/function/f_mass_storage.c | 13 +++++++------ drivers/usb/gadget/function/storage_common.h | 1 + 2 files changed, 8 insertions(+), 6 deletions(-)