Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3968cc61 authored by Udipto Goswami's avatar Udipto Goswami Committed by Gerrit - the friendly Code Review server
Browse files

usb: gadget: f_mtp: Failing receive_file_work if state is OFFLINE 



If unbind and receive_file_work takes place in parallel,
since unbind has the mutex_lock first receive_file_work
must wait until it is freed. Once it gets the mutex_lock it
starts processing again but till then unbind would have
cleared the request which leads to a slab poison error.

Fix this by check inside receive_file_work after mutex_lock
if the state is offline and bail out.

Change-Id: I27c7ed3d75c46d4d360b0d3d798924b5254a0216
Signed-off-by: default avatarUdipto Goswami <ugoswami@codeaurora.org>
parent cfab2293

drivers/usb/gadget/function/f_mtp.c

+5 −0
Original line number Original line Diff line number Diff line
@@ -944,6 +944,10 @@ static void receive_file_work(struct work_struct *data) 
		mtp_log("- count(%lld) not multiple of mtu(%d)\n",

		mtp_log("- count(%lld) not multiple of mtu(%d)\n",

						count, dev->ep_out->maxpacket);

						count, dev->ep_out->maxpacket);

	mutex_lock(&dev->read_mutex);

	mutex_lock(&dev->read_mutex);

	if (dev->state == STATE_OFFLINE) {

		r = -EIO;

		goto fail;

	}

	while (count > 0 || write_req) {

	while (count > 0 || write_req) {

		if (count > 0) {

		if (count > 0) {

			/* queue a request */

			/* queue a request */
@@ -1026,6 +1030,7 @@ static void receive_file_work(struct work_struct *data) 
			read_req = NULL;

			read_req = NULL;

		}

		}

	}

	}

fail:

	mutex_unlock(&dev->read_mutex);

	mutex_unlock(&dev->read_mutex);

	mtp_log("returning %d\n", r);

	mtp_log("returning %d\n", r);

	/* write the result */

	/* write the result */