The other thread may access other endpoints when the cdns3_check_new_setup is handling, add spinlock to protect it.

Cc: stable@vger.kernel.org Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Signed-off-by: Peter Chen peter.chen@nxp.com

Reviewed-by: Pawel Laszczak pawell@cadence.com

---

drivers/usb/cdns3/ep0.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/cdns3/ep0.c b/drivers/usb/cdns3/ep0.c index 74a1ff5000ba..5aa69980e7ff 100644 --- a/drivers/usb/cdns3/ep0.c +++ b/drivers/usb/cdns3/ep0.c @@ -705,15 +705,17 @@ static int cdns3_gadget_ep0_queue(struct usb_ep *ep, int ret = 0; u8 zlp = 0;

• spin_lock_irqsave(&priv_dev->lock, flags); trace_cdns3_ep0_queue(priv_dev, request);

  /* cancel the request if controller receive new SETUP packet. */

• if (cdns3_check_new_setup(priv_dev))

• if (cdns3_check_new_setup(priv_dev)) {

• spin_unlock_irqrestore(&priv_dev->lock, flags);
  

  return -ECONNRESET;

• }

  /* send STATUS stage. Should be called only for SET_CONFIGURATION */ if (priv_dev->ep0_stage == CDNS3_STATUS_STAGE) {

• spin_lock_irqsave(&priv_dev->lock, flags);
  

  cdns3_select_ep(priv_dev, 0x00);

  erdy_sent = !priv_dev->hw_configured_flag;

@@ -738,7 +740,6 @@ static int cdns3_gadget_ep0_queue(struct usb_ep *ep, return 0; }

• spin_lock_irqsave(&priv_dev->lock, flags); if (!list_empty(&priv_ep->pending_req_list)) { dev_err(priv_dev->dev, "can't handle multiple requests for ep0\n");

-- 2.17.1