Re: [PATCH 4.19.y 2/3] usb: dwc3: gadget: prevent dwc3_request from being queued twice

[Greg KH <greg@kroah.com>]

On Mon, Jul 29, 2019 at 07:13:38PM +0530, Saranya Gopal wrote:
> From: Felipe Balbi <felipe.balbi@linux.intel.com>
> 
> [Upstream commit b2b6d601365a1acb90b87c85197d79]
> 
> Queueing the same request twice can introduce hard-to-debug
> problems. At least one function driver - Android's f_mtp.c - is known
> to cause this problem.
> 
> While that function is out-of-tree, this is a problem that's easy
> enough to avoid.
> 
> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
> Signed-off-by: Saranya Gopal <saranya.gopal@intel.com>
> ---
>  drivers/usb/dwc3/gadget.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index 3f337a0..a56a92a 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -1291,6 +1291,11 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
>  				&req->request, req->dep->name))
>  		return -EINVAL;
>  
> +	if (WARN(req->status < DWC3_REQUEST_STATUS_COMPLETED,
> +				"%s: request %pK already in flight\n",
> +				dep->name, &req->request))
> +		return -EINVAL;

So we are going to trip syzbot up on this out-of-tree driver?  Brave...