usb: gadget: udc-core: fix a regression during gadget driver unbinding
authorAlan Stern <stern@rowland.harvard.edu>
Fri, 15 Mar 2013 18:02:14 +0000 (14:02 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 5 Apr 2013 16:26:05 +0000 (09:26 -0700)
commitcf0dd5c0a89b0b5d15073fdbbefdaea627e38966
treeafeb18d7c166f96814cd0764e65ee5df40ccc5ce
parent0a9f03287a9290fb61aa74604b4f8fd7fdd3b64e
usb: gadget: udc-core: fix a regression during gadget driver unbinding

commit 511f3c5326eabe1ece35202a404c24c0aeacc246 upstream.

This patch (as1666) fixes a regression in the UDC core.  The core
takes care of unbinding gadget drivers, and it does the unbinding
before telling the UDC driver to turn off the controller hardware.
When the call to the udc_stop callback is made, the gadget no longer
has a driver.  The callback routine should not be invoked with a
pointer to the old driver; doing so can cause problems (such as
use-after-free accesses in net2280).

This patch should be applied, with appropriate context changes, to all
the stable kernels going back to 3.1.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/gadget/udc-core.c