usb: wwan: Avoid RX URB submission races
Since commit 6f806b8fa362b53f10947c65af2df8d4acb10b61 "usb: serial:
Add flow control between wwan and tty drivers", pushing of received
URB data into TTY has been offloaded into a work queue. Only after
the data is transferred will the URB be resubmitted. This can race
with usb_wwan_resume, which unconditionally submits all the available
IN URBs. Hence the double call to usb_anchor_urb will corrupt the
anchor list, the second submission will fail, and the following
usb_unanchor_urb will result in the list pointing to a now unlinked
URB. Thus portdata->in_urb_list will never be exhausted as it can
never be traversed fully, and the work function will keep attempting
to resubmit the problematic URB over and over again.
Fix this by ensuring that an URB to be submitted is both not already
anchored and its urb_list member is not part of a list, so that it
cannot be submitted multiple times. Also, don't allow the work
queue function to resubmit the URB if the interface is suspended.
CRs-Fixed: 390847
Change-Id: I13f7956962887e45520d6f3bdf3b179b75a9403f
Signed-off-by:
Jack Pham <jackp@codeaurora.org>
Loading
Please register or sign in to comment