usb: u_bam: Free endpoint request buffer on disconnect
Some controller drivers (e.g. DWC3) keep a mapping between USB
request and its corresponding endpoint on request allocation.
This is later used by DCD when request is queued.
During USB disconnect, u_bam disables IN ep and adds the request
back to tx_idle pool instead of freeing it. This USB request in
idle pool may point to invalid EP if composition switch happens
resulting in u_bam's IN EP getting assigned to some other function.
Later when u_bam tries to enqueue this request again, DCD may queue
to the old EP now used by some other function. Fix this by freeing
usb_request on disconnect.
Change-Id: I0f18a8c85fce636bab4bb4e5bb7e85365339f2a9
CRs-Fixed: 468071
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
diff --git a/drivers/usb/gadget/u_bam.c b/drivers/usb/gadget/u_bam.c
index 3c3fbca..67c9a1a 100644
--- a/drivers/usb/gadget/u_bam.c
+++ b/drivers/usb/gadget/u_bam.c
@@ -363,10 +363,13 @@
switch (status) {
case 0:
/* successful completion */
+ break;
case -ECONNRESET:
case -ESHUTDOWN:
/* connection gone */
- break;
+ dev_kfree_skb_any(skb);
+ usb_ep_free_request(ep, req);
+ return;
default:
pr_err("%s: data tx ep error %d\n",
__func__, status);