Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6dd433e6 authored by Oliver Neukum's avatar Oliver Neukum Committed by Greg Kroah-Hartman
Browse files

USB: cdc-wdm: fix race between interrupt handler and tasklet 



Both could want to submit the same URB. Some checks of the flag
intended to prevent that were missing.

Signed-off-by: default avatarOliver Neukum <oneukum@suse.de>
CC: stable@vger.kernel.org
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e9a088fa

drivers/usb/class/cdc-wdm.c

+9 −4
Original line number Diff line number Diff line
@@ -209,6 +209,7 @@ static void wdm_in_callback(struct urb *urb) 
static void wdm_int_callback(struct urb *urb)

{

	int rv = 0;

	int responding;

	int status = urb->status;

	struct wdm_device *desc;

	struct usb_cdc_notification *dr;
@@ -262,8 +263,8 @@ static void wdm_int_callback(struct urb *urb) 


	spin_lock(&desc->iuspin);

	clear_bit(WDM_READ, &desc->flags);

	set_bit(WDM_RESPONDING, &desc->flags);

	if (!test_bit(WDM_DISCONNECTING, &desc->flags)

	responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);

	if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags)

		&& !test_bit(WDM_SUSPENDING, &desc->flags)) {

		rv = usb_submit_urb(desc->response, GFP_ATOMIC);

		dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
@@ -685,16 +686,20 @@ static void wdm_rxwork(struct work_struct *work) 
{

	struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);

	unsigned long flags;

	int rv;

	int rv = 0;

	int responding;



	spin_lock_irqsave(&desc->iuspin, flags);

	if (test_bit(WDM_DISCONNECTING, &desc->flags)) {

		spin_unlock_irqrestore(&desc->iuspin, flags);

	} else {

		responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);

		spin_unlock_irqrestore(&desc->iuspin, flags);

		if (!responding)

			rv = usb_submit_urb(desc->response, GFP_KERNEL);

		if (rv < 0 && rv != -EPERM) {

			spin_lock_irqsave(&desc->iuspin, flags);

			clear_bit(WDM_RESPONDING, &desc->flags);

			if (!test_bit(WDM_DISCONNECTING, &desc->flags))

				schedule_work(&desc->rxwork);

			spin_unlock_irqrestore(&desc->iuspin, flags);