Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ae5943de authored by Malcolm Priestley's avatar Malcolm Priestley Committed by Greg Kroah-Hartman
Browse files

staging: vt6656: Fix URB submitted while active warning. 



This error happens because PIPEnsControlOut and PIPEnsControlIn unlock the
spin lock for delay, letting in another thread.

The patch moves the current MP_SET_FLAG to before filling
of sUsbCtlRequest for pControlURB and clears it in event of failing.

Any thread calling either function while fMP_CONTROL_READS or fMP_CONTROL_WRITES
flags set will return STATUS_FAILURE.

Signed-off-by: default avatarMalcolm Priestley <tvboxspy@gmail.com>
Cc: stable@vger.kernel.org # 3.8
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d13b0b6d

drivers/staging/vt6656/usbpipe.c

+20 −8
Original line number Diff line number Diff line
@@ -126,6 +126,11 @@ int PIPEnsControlOut(struct vnt_private *pDevice, u8 byRequest, u16 wValue, 
    if (pDevice->Flags & fMP_CONTROL_WRITES)

        return STATUS_FAILURE;



	if (pDevice->Flags & fMP_CONTROL_READS)

		return STATUS_FAILURE;



	MP_SET_FLAG(pDevice, fMP_CONTROL_WRITES);



	pDevice->sUsbCtlRequest.bRequestType = 0x40;

	pDevice->sUsbCtlRequest.bRequest = byRequest;

	pDevice->sUsbCtlRequest.wValue = cpu_to_le16p(&wValue);
@@ -140,12 +145,13 @@ int PIPEnsControlOut(struct vnt_private *pDevice, u8 byRequest, u16 wValue, 


	ntStatus = usb_submit_urb(pDevice->pControlURB, GFP_ATOMIC);

	if (ntStatus != 0) {

		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"control send request submission failed: %d\n", ntStatus);

		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO

			"control send request submission failed: %d\n",

				ntStatus);

		MP_CLEAR_FLAG(pDevice, fMP_CONTROL_WRITES);

		return STATUS_FAILURE;

	}

	else {

	    MP_SET_FLAG(pDevice, fMP_CONTROL_WRITES);

	}



	spin_unlock_irq(&pDevice->lock);

    for (ii = 0; ii <= USB_CTL_WAIT; ii ++) {
@@ -179,6 +185,11 @@ int PIPEnsControlIn(struct vnt_private *pDevice, u8 byRequest, u16 wValue, 
    if (pDevice->Flags & fMP_CONTROL_READS)

	return STATUS_FAILURE;



	if (pDevice->Flags & fMP_CONTROL_WRITES)

		return STATUS_FAILURE;



	MP_SET_FLAG(pDevice, fMP_CONTROL_READS);



	pDevice->sUsbCtlRequest.bRequestType = 0xC0;

	pDevice->sUsbCtlRequest.bRequest = byRequest;

	pDevice->sUsbCtlRequest.wValue = cpu_to_le16p(&wValue);
@@ -192,9 +203,10 @@ int PIPEnsControlIn(struct vnt_private *pDevice, u8 byRequest, u16 wValue, 


	ntStatus = usb_submit_urb(pDevice->pControlURB, GFP_ATOMIC);

	if (ntStatus != 0) {

		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"control request submission failed: %d\n", ntStatus);

	}else {

		MP_SET_FLAG(pDevice, fMP_CONTROL_READS);

		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO

			"control request submission failed: %d\n", ntStatus);

		MP_CLEAR_FLAG(pDevice, fMP_CONTROL_READS);

		return STATUS_FAILURE;

	}



	spin_unlock_irq(&pDevice->lock);