[PATCH] usb: gadget: lpc32xx_udc: Fix a race in lpc32xx_get_frame()

[PATCH] usb: gadget: lpc32xx_udc: Fix a race in lpc32xx_get_frame()

[Ginger Li]

lpc32xx_get_frame() tests udc->clocked before it takes udc->lock, but
udc->clocked is cleared by udc_clk_set() with the lock held, for example from
lpc32xx_vbus_session() when the session is disconnected, which also gates the
UDC clock.

When the test passes on a stale value, udc_get_current_frame() then reads UDC
registers whose clock has already been turned off.  Check udc->clocked inside
the critical section so that the state can not change between the check and
the register access.

Fixes: 24a28e428351 ("USB: gadget driver for LPC32xx")
Signed-off-by: Ginger Li <ginger.jzllee@gmail.com>
---
 drivers/usb/gadget/udc/lpc32xx_udc.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
--- a/drivers/usb/gadget/udc/lpc32xx_udc.c
+++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
@@ -2403,10 +2403,12 @@ static int lpc32xx_get_frame(struct usb_gadget *gadget
 	unsigned long flags;
 	struct lpc32xx_udc *udc = to_udc(gadget);
 
-	if (!udc->clocked)
-		return -EINVAL;
+	spin_lock_irqsave(&udc->lock, flags);
 
-	spin_lock_irqsave(&udc->lock, flags);
+	if (!udc->clocked) {
+		spin_unlock_irqrestore(&udc->lock, flags);
+		return -EINVAL;
+	}
 
 	frame = (int) udc_get_current_frame(udc);
 
-- 
2.43.0