• Alexey Khoroshilov's avatar
    ath9k_htc: fix data race between request_firmware_nowait() callback and suspend() · 9494849e
    Alexey Khoroshilov authored
    ath9k_hif_usb_probe() requests firmware asynchronically and
    there is some initialization postponed till firmware is ready.
    In particular, ath9k_hif_usb_firmware_cb() callback initializes
    hif_dev->tx.tx_buf and hif_dev->tx.tx_pending lists.
    
    At the same time, ath9k_hif_usb_suspend() iterates that lists through
    ath9k_hif_usb_dealloc_urbs(). If suspend happens before request_firmware_nowait()
    callback is called, it can lead to oops.
    
    Similar issue could be in ath9k_hif_usb_disconnect(), but it is prevented
    using hif_dev->fw_done completion and HIF_USB_READY flag. The patch extends
    this approach to suspend() as well.
    
    Found by Linux Driver Verification project (linuxtesting.org).
    Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
    Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
    9494849e
hif_usb.c 31.2 KB