Re: [PATCH 19/19] usb: dwc2: wait for the TT clear in endpoint_disable

[sashiko-bot@kernel.org]

> From: Josef Bacik <josef@toxicpanda.com>
> 
> When a split transaction fails, dwc2_hc_handle_tt_clear() sets
> qh->tt_buffer_dirty and calls usb_hub_clear_tt_buffer(). The hub driver
> stores urb->ep in its list and hub_tt_work() hands it back to
> _dwc2_hcd_clear_tt_buffer_complete() after the CLEAR_TT_BUFFER request to
> the hub, which can take up to a second if the hub does not answer.
> 
> Nothing keeps the endpoint until then. dwc2_hcd_endpoint_disable() only
> waits for the QTD list to drain and frees the QH. If the full or low
> speed device is unplugged, usb_disconnect() goes on to free the
> usb_device and its configurations, which hold the struct
> usb_host_endpoint. The callback then reads ep->hcpriv from freed memory
> and, if it is not NULL, clears a bit in whatever it points to. A change
> of the configuration or altsetting only frees the QH, under a callback
> [ ... ]
> Fixes: 7359d482eb4d ("staging: HCD files for the DWC2 driver")
> Cc: stable <stable@kernel.org>
> Cc: Minas Harutyunyan <hminas@synopsys.com>
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027-llm-usb-v1-0-b9751ddb9c7c@linuxfoundation.org?part=19