From fb22ae6c7e0ffe438103c948c87c5ddf2ef56e7e Mon Sep 17 00:00:00 2001 From: Stephen Warren Date: Mon, 23 Jun 2014 12:02:48 -0600 Subject: [PATCH] usb: ci_udc: fix interaction with CONFIG_USB_ETH_CDC ci_udc.c's usb_gadget_unregister_driver() doesn't call driver->unbind() unlike other USB gadget drivers. Fix it to do this. Without this, when ether.c's CDC Ethernet device is torn down, eth_unbind() is never called, so dev->gadget is never set to NULL. For some reason, usb_eth_halt() is called both at the end of the first use of the Ethernet device, and prior to any subsequent use. Since dev->gadget is never cleared, all calls to usb_eth_halt() attempt to stop, disconnect, and clean up the device, resulting in double cleanup, which hangs U-Boot on my Tegra device at least. ci_udc allocates its own singleton EP0 request object, and cleans it up during usb_gadget_unregister_driver(). This appears necessary when using the USB gadget framework in U-Boot, since that does not allocate/free the EP0 request. However, the CDC Ethernet driver *does* allocate and free its own EP0 requests. Consequently, we must protect ci_ep_free_request() against double-freeing the request. Signed-off-by: Stephen Warren --- drivers/usb/gadget/ci_udc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/ci_udc.c b/drivers/usb/gadget/ci_udc.c index b18bee43ad..c3f6467b7d 100644 --- a/drivers/usb/gadget/ci_udc.c +++ b/drivers/usb/gadget/ci_udc.c @@ -226,8 +226,11 @@ static void ci_ep_free_request(struct usb_ep *ep, struct usb_request *req) int num; num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK; - if (num == 0) + if (num == 0) { + if (!controller.ep0_req) + return; controller.ep0_req = 0; + } if (ci_req->b_buf) free(ci_req->b_buf); @@ -909,6 +912,9 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver) { udc_disconnect(); + driver->unbind(&controller.gadget); + controller.driver = NULL; + ci_ep_free_request(&controller.ep[0].ep, &controller.ep0_req->req); free(controller.items_mem); free(controller.epts); -- 2.25.1