[PATCH v2 3/7] usb: mtu3: fix kernel panic at qmu transfer done irq handler

[Chunfeng Yun (云春峰)]

On Fri, 2023-04-07 at 11:09 +0200, AngeloGioacchino Del Regno wrote:
> External email : Please do not click links or open attachments until
> you have verified the sender or the content.
> 
> 
> Il 07/04/23 10:29, Chunfeng Yun ha scritto:
> > When handle qmu transfer irq, it will unlock @mtu->lock before give
> > back
> > request, if another thread handle disconnect event at the same
> > time, and
> > try to disable ep, it may lock @mtu->lock and free qmu ring, then
> > qmu
> > irq hanlder may get a NULL gpd, avoid the KE by checking gpd's
> > value before
> > handling it.
> > 
> > e.g.
> > qmu done irq on cpu0                 thread running on cpu1
> > 
> > qmu_done_tx()
> >    handle gpd [0]
> >      mtu3_requ_complete()        mtu3_gadget_ep_disable()
> >        unlock @mtu->lock
> >          give back request         lock @mtu->lock
> >                                      mtu3_ep_disable()
> >                                        mtu3_gpd_ring_free()
> >                                     unlock @mtu->lock
> >        lock @mtu->lock
> >      get next gpd [1]
> > 
> > [1]: goto [0] to handle next gpd, and next gpd may be NULL.
> > 
> > Signed-off-by: Chunfeng Yun <chunfeng.yun at mediatek.com>
> 
> NACK. You still miss the Fixes tag.
Ok, I'll add it, thanks

> 
> Regards,
> Angelo
>