Commit ca5c485f authored Jul 06, 2011 by Alan Stern Committed by Greg Kroah-Hartman Jul 07, 2011

USB: additional regression fix for device removal



Commit e534c5b8 (USB: fix regression
occurring during device removal) didn't go far enough.  It failed to
take into account that when a driver claims multiple interfaces, it may
release them all at the same time.  As a result, some interfaces can
get released before they are unregistered, and we deadlock trying to
acquire the bandwidth_mutex that we already own.

This patch (asl478) handles this case by setting the "unregistering"
flag on all the interfaces before removing any of them.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@kernel.org>
Tested-by: Éric Piel <eric.piel@tremplin-utc.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

parent e534c5b8

drivers/usb/core/message.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -1147,6 +1147,14 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
		* any drivers bound to them (a key side effect)
		*/
		if (dev->actconfig) {
		/*
		* FIXME: In order to avoid self-deadlock involving the
		* bandwidth_mutex, we have to mark all the interfaces
		* before unregistering any of them.
		*/
		for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++)
		dev->actconfig->interface[i]->unregistering = 1;

		for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
		struct usb_interface *interface;

		@@ -1156,7 +1164,6 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
		continue;
		dev_dbg(&dev->dev, "unregistering interface %s\n",
		dev_name(&interface->dev));
		interface->unregistering = 1;
		remove_intf_ep_devs(interface);
		device_del(&interface->dev);
		}