mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 10:49:33 +00:00
misc: rtsx_usb: use separate command and response buffers
commit 3776c78559
upstream.
rtsx_usb uses same buffer for command and response. There could
be a potential conflict using the same buffer for both especially
if retries and timeouts are involved.
Use separate command and response buffers to avoid conflicts.
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/07e3721804ff07aaab9ef5b39a5691d0718b9ade.1656642167.git.skhan@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
af7d9d4abe
commit
ff79e0ca2b
2 changed files with 17 additions and 10 deletions
|
@ -631,15 +631,18 @@ static int rtsx_usb_probe(struct usb_interface *intf,
|
||||||
|
|
||||||
ucr->pusb_dev = usb_dev;
|
ucr->pusb_dev = usb_dev;
|
||||||
|
|
||||||
ucr->iobuf = kmalloc(IOBUF_SIZE, GFP_KERNEL);
|
ucr->cmd_buf = kmalloc(IOBUF_SIZE, GFP_KERNEL);
|
||||||
if (!ucr->iobuf)
|
if (!ucr->cmd_buf)
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
|
|
||||||
|
ucr->rsp_buf = kmalloc(IOBUF_SIZE, GFP_KERNEL);
|
||||||
|
if (!ucr->rsp_buf)
|
||||||
|
goto out_free_cmd_buf;
|
||||||
|
|
||||||
usb_set_intfdata(intf, ucr);
|
usb_set_intfdata(intf, ucr);
|
||||||
|
|
||||||
ucr->vendor_id = id->idVendor;
|
ucr->vendor_id = id->idVendor;
|
||||||
ucr->product_id = id->idProduct;
|
ucr->product_id = id->idProduct;
|
||||||
ucr->cmd_buf = ucr->rsp_buf = ucr->iobuf;
|
|
||||||
|
|
||||||
mutex_init(&ucr->dev_mutex);
|
mutex_init(&ucr->dev_mutex);
|
||||||
|
|
||||||
|
@ -667,9 +670,11 @@ static int rtsx_usb_probe(struct usb_interface *intf,
|
||||||
|
|
||||||
out_init_fail:
|
out_init_fail:
|
||||||
usb_set_intfdata(ucr->pusb_intf, NULL);
|
usb_set_intfdata(ucr->pusb_intf, NULL);
|
||||||
kfree(ucr->iobuf);
|
kfree(ucr->rsp_buf);
|
||||||
ucr->iobuf = NULL;
|
ucr->rsp_buf = NULL;
|
||||||
ucr->cmd_buf = ucr->rsp_buf = NULL;
|
out_free_cmd_buf:
|
||||||
|
kfree(ucr->cmd_buf);
|
||||||
|
ucr->cmd_buf = NULL;
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -682,9 +687,12 @@ static void rtsx_usb_disconnect(struct usb_interface *intf)
|
||||||
mfd_remove_devices(&intf->dev);
|
mfd_remove_devices(&intf->dev);
|
||||||
|
|
||||||
usb_set_intfdata(ucr->pusb_intf, NULL);
|
usb_set_intfdata(ucr->pusb_intf, NULL);
|
||||||
kfree(ucr->iobuf);
|
|
||||||
ucr->iobuf = NULL;
|
kfree(ucr->cmd_buf);
|
||||||
ucr->cmd_buf = ucr->rsp_buf = NULL;
|
ucr->cmd_buf = NULL;
|
||||||
|
|
||||||
|
kfree(ucr->rsp_buf);
|
||||||
|
ucr->rsp_buf = NULL;
|
||||||
}
|
}
|
||||||
|
|
||||||
#ifdef CONFIG_PM
|
#ifdef CONFIG_PM
|
||||||
|
|
|
@ -54,7 +54,6 @@ struct rtsx_ucr {
|
||||||
struct usb_device *pusb_dev;
|
struct usb_device *pusb_dev;
|
||||||
struct usb_interface *pusb_intf;
|
struct usb_interface *pusb_intf;
|
||||||
struct usb_sg_request current_sg;
|
struct usb_sg_request current_sg;
|
||||||
unsigned char *iobuf;
|
|
||||||
|
|
||||||
struct timer_list sg_timer;
|
struct timer_list sg_timer;
|
||||||
struct mutex dev_mutex;
|
struct mutex dev_mutex;
|
||||||
|
|
Loading…
Reference in a new issue