mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-28 15:20:41 +00:00
staging: most: usb: fix usb_disconnect race condition
The functions usb_disconnect and usb_sndbulkpipe are racing for the struct usb_device, which might cause a null pointer dereference exception. This patch fixes this race condition by protecting the critical section inside the function hdm_enque with the io_mutex. Signed-off-by: Christian Gromm <christian.gromm@microchip.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
9a32315b0b
commit
c06b99e002
1 changed files with 14 additions and 7 deletions
|
@ -565,14 +565,19 @@ static int hdm_enqueue(struct most_interface *iface, int channel,
|
||||||
|
|
||||||
mdev = to_mdev(iface);
|
mdev = to_mdev(iface);
|
||||||
conf = &mdev->conf[channel];
|
conf = &mdev->conf[channel];
|
||||||
|
|
||||||
|
mutex_lock(&mdev->io_mutex);
|
||||||
|
if (!mdev->usb_device) {
|
||||||
|
retval = -ENODEV;
|
||||||
|
goto _exit;
|
||||||
|
}
|
||||||
|
|
||||||
dev = &mdev->usb_device->dev;
|
dev = &mdev->usb_device->dev;
|
||||||
|
|
||||||
if (!mdev->usb_device)
|
|
||||||
return -ENODEV;
|
|
||||||
|
|
||||||
urb = usb_alloc_urb(NO_ISOCHRONOUS_URB, GFP_ATOMIC);
|
urb = usb_alloc_urb(NO_ISOCHRONOUS_URB, GFP_ATOMIC);
|
||||||
if (!urb)
|
if (!urb) {
|
||||||
return -ENOMEM;
|
retval = -ENOMEM;
|
||||||
|
goto _exit;
|
||||||
|
}
|
||||||
|
|
||||||
if ((conf->direction & MOST_CH_TX) && mdev->padding_active[channel] &&
|
if ((conf->direction & MOST_CH_TX) && mdev->padding_active[channel] &&
|
||||||
hdm_add_padding(mdev, channel, mbo)) {
|
hdm_add_padding(mdev, channel, mbo)) {
|
||||||
|
@ -613,12 +618,14 @@ static int hdm_enqueue(struct most_interface *iface, int channel,
|
||||||
dev_err(dev, "URB submit failed with error %d.\n", retval);
|
dev_err(dev, "URB submit failed with error %d.\n", retval);
|
||||||
goto _error_1;
|
goto _error_1;
|
||||||
}
|
}
|
||||||
return 0;
|
goto _exit;
|
||||||
|
|
||||||
_error_1:
|
_error_1:
|
||||||
usb_unanchor_urb(urb);
|
usb_unanchor_urb(urb);
|
||||||
_error:
|
_error:
|
||||||
usb_free_urb(urb);
|
usb_free_urb(urb);
|
||||||
|
_exit:
|
||||||
|
mutex_unlock(&mdev->io_mutex);
|
||||||
return retval;
|
return retval;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue