Commit 9de8720a authored by Lu Baolu's avatar Lu Baolu Committed by Greg Kroah-Hartman

mfd: rtsx_usb: Avoid setting ucr->current_sg.status

commit 8dcc5ff8 upstream.

Member "status" of struct usb_sg_request is managed by usb core. A
spin lock is used to serialize the change of it. The driver could
check the value of req->status, but should avoid changing it without
the hold of the spinlock. Otherwise, it could cause race or error
in usb core.

This patch could be backported to stable kernels with version later
than v3.14.

Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Roger Tseng <rogerable@realtek.com>
Signed-off-by: default avatarLu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a2afa5f1
...@@ -46,9 +46,6 @@ static void rtsx_usb_sg_timed_out(unsigned long data) ...@@ -46,9 +46,6 @@ static void rtsx_usb_sg_timed_out(unsigned long data)
dev_dbg(&ucr->pusb_intf->dev, "%s: sg transfer timed out", __func__); dev_dbg(&ucr->pusb_intf->dev, "%s: sg transfer timed out", __func__);
usb_sg_cancel(&ucr->current_sg); usb_sg_cancel(&ucr->current_sg);
/* we know the cancellation is caused by time-out */
ucr->current_sg.status = -ETIMEDOUT;
} }
static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr, static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr,
...@@ -67,12 +64,15 @@ static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr, ...@@ -67,12 +64,15 @@ static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr,
ucr->sg_timer.expires = jiffies + msecs_to_jiffies(timeout); ucr->sg_timer.expires = jiffies + msecs_to_jiffies(timeout);
add_timer(&ucr->sg_timer); add_timer(&ucr->sg_timer);
usb_sg_wait(&ucr->current_sg); usb_sg_wait(&ucr->current_sg);
del_timer_sync(&ucr->sg_timer); if (!del_timer_sync(&ucr->sg_timer))
ret = -ETIMEDOUT;
else
ret = ucr->current_sg.status;
if (act_len) if (act_len)
*act_len = ucr->current_sg.bytes; *act_len = ucr->current_sg.bytes;
return ucr->current_sg.status; return ret;
} }
int rtsx_usb_transfer_data(struct rtsx_ucr *ucr, unsigned int pipe, int rtsx_usb_transfer_data(struct rtsx_ucr *ucr, unsigned int pipe,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment