Commit 5f9f0b11 authored by Oliver Neukum's avatar Oliver Neukum Committed by David S. Miller

nfc: port100: handle command failure cleanly

If starting the transfer of a command suceeds but the transfer for the reply
fails, it is not enough to initiate killing the transfer for the
command may still be running. You need to wait for the killing to finish
before you can reuse URB and buffer.

Reported-and-tested-by: syzbot+711468aa5c3a1eabf863@syzkaller.appspotmail.com
Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 48a322b6
...@@ -783,7 +783,7 @@ static int port100_send_frame_async(struct port100 *dev, struct sk_buff *out, ...@@ -783,7 +783,7 @@ static int port100_send_frame_async(struct port100 *dev, struct sk_buff *out,
rc = port100_submit_urb_for_ack(dev, GFP_KERNEL); rc = port100_submit_urb_for_ack(dev, GFP_KERNEL);
if (rc) if (rc)
usb_unlink_urb(dev->out_urb); usb_kill_urb(dev->out_urb);
exit: exit:
mutex_unlock(&dev->out_urb_lock); mutex_unlock(&dev->out_urb_lock);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment