usb: gadget: Use usb_put_function instead of usb_remove_function

When the gadget is disabled with writing "0" to the "enable" attribute,
usb_remove_config() is called, and it calls remove_config(), which in
turn removes a function (list_del(&f->list)) from a list of functions
in the configuration, then calls e.g. acm function's unbind
(acm_unbind()),
then calls slp_multi_unbind_config(), which
calls slp_multi_unbind_enabled_functions(), which, for the acm function,
calls acm_function_unbind_config() which then does usb_remove_config()
and the latter attempts to once again remove a function
(list_del(&f->list)) from a list of functions in the configuration.
Since the list_head of an already deleted entry has LIST_POISON1 and
LIST_POISON2 in its prev and next pointers, dereferencing them in
list_del() causes a page fault.
The fix is to use usb_put_function instead, because when it is called
the function is already removed.
This patch also cleans up
the places usb_get/put_function_instance() and usb_get/put_function()
are called.

Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>

0 files changed, 0 insertions, 0 deletions