usb: musb: Get the musb_qh poniter after musb_giveback
authorXingxing Luo <xingxing.luo@unisoc.com>
Tue, 19 Sep 2023 03:30:55 +0000 (11:30 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 2 Oct 2023 11:37:57 +0000 (13:37 +0200)
commit33d7e37232155aadebe4145dcc592f00dabd7a2b
treefa2304a12ccee5fc4d129243854d0ffb1269c19e
parent6658a62e1ddf726483cb2d8bf45ea3f9bd533074
usb: musb: Get the musb_qh poniter after musb_giveback

When multiple threads are performing USB transmission, musb->lock will be
unlocked when musb_giveback is executed. At this time, qh may be released
in the dequeue process in other threads, resulting in a wild pointer, so
it needs to be here get qh again, and judge whether qh is NULL, and when
dequeue, you need to set qh to NULL.

Fixes: dbac5d07d13e ("usb: musb: host: don't start next rx urb if current one failed")
Cc: stable@vger.kernel.org
Signed-off-by: Xingxing Luo <xingxing.luo@unisoc.com>
Link: https://lore.kernel.org/r/20230919033055.14085-1-xingxing.luo@unisoc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/musb/musb_host.c