Commit 52a39f2c authored by Michal Grzeschik's avatar Michal Grzeschik Committed by Greg Kroah-Hartman
Browse files

usb: gadget: uvc: cleanup request when not in correct state 



The uvc_video_enable function of the uvc-gadget driver is dequeing and
immediately deallocs all requests on its disable codepath. This is not
save since the dequeue function is async and does not ensure that the
requests are left unlinked in the controller driver.

By adding the ep_free_request into the completion path of the requests
we ensure that the request will be properly deallocated.

Signed-off-by: default avatarMichael Grzeschik <m.grzeschik@pengutronix.de>
Link: https://lore.kernel.org/r/20230911140530.2995138-3-m.grzeschik@pengutronix.de


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3a63f86c

drivers/usb/gadget/function/uvc_video.c

+6 −0
Original line number Diff line number Diff line
@@ -256,6 +256,12 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req) 
	struct uvc_device *uvc = video->uvc;

	unsigned long flags;



	if (uvc->state == UVC_STATE_CONNECTED) {

		usb_ep_free_request(video->ep, ureq->req);

		ureq->req = NULL;

		return;

	}



	switch (req->status) {

	case 0:

		break;