Commit 35bdf9a6 authored by OGAWA Hirofumi's avatar OGAWA Hirofumi Committed by Greg Kroah-Hartman

nfc: Fix hangup of RC-S380* in port100_send_ack()

commit 24971281 upstream.

If port100_send_ack() was called twice or more, it has race to hangup.

  port100_send_ack()          port100_send_ack()
    init_completion()
    [...]
    dev->cmd_cancel = true
                                /* this removes previous from completion */
                                init_completion()
				[...]
                                dev->cmd_cancel = true
                                wait_for_completion()
    /* never be waked up */
    wait_for_completion()

Like above race, this code is not assuming port100_send_ack() is
called twice or more.

To fix, this checks dev->cmd_cancel to know if prior cancel is
in-flight or not. And never be remove prior task from completion by
using reinit_completion(), so this guarantees to be waked up properly
soon or later.
Signed-off-by: default avatarOGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: default avatarSamuel Ortiz <sameo@linux.intel.com>
Signed-off-by: default avatarAmit Pundir <amit.pundir@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 6b3d13fe
......@@ -725,23 +725,33 @@ static int port100_submit_urb_for_ack(struct port100 *dev, gfp_t flags)
static int port100_send_ack(struct port100 *dev)
{
int rc;
int rc = 0;
mutex_lock(&dev->out_urb_lock);
init_completion(&dev->cmd_cancel_done);
/*
* If prior cancel is in-flight (dev->cmd_cancel == true), we
* can skip to send cancel. Then this will wait the prior
* cancel, or merged into the next cancel rarely if next
* cancel was started before waiting done. In any case, this
* will be waked up soon or later.
*/
if (!dev->cmd_cancel) {
reinit_completion(&dev->cmd_cancel_done);
usb_kill_urb(dev->out_urb);
usb_kill_urb(dev->out_urb);
dev->out_urb->transfer_buffer = ack_frame;
dev->out_urb->transfer_buffer_length = sizeof(ack_frame);
rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
dev->out_urb->transfer_buffer = ack_frame;
dev->out_urb->transfer_buffer_length = sizeof(ack_frame);
rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
/* Set the cmd_cancel flag only if the URB has been successfully
* submitted. It will be reset by the out URB completion callback
* port100_send_complete().
*/
dev->cmd_cancel = !rc;
/*
* Set the cmd_cancel flag only if the URB has been
* successfully submitted. It will be reset by the out
* URB completion callback port100_send_complete().
*/
dev->cmd_cancel = !rc;
}
mutex_unlock(&dev->out_urb_lock);
......@@ -928,8 +938,8 @@ static void port100_send_complete(struct urb *urb)
struct port100 *dev = urb->context;
if (dev->cmd_cancel) {
complete_all(&dev->cmd_cancel_done);
dev->cmd_cancel = false;
complete(&dev->cmd_cancel_done);
}
switch (urb->status) {
......@@ -1543,6 +1553,7 @@ static int port100_probe(struct usb_interface *interface,
PORT100_COMM_RF_HEAD_MAX_LEN;
dev->skb_tailroom = PORT100_FRAME_TAIL_LEN;
init_completion(&dev->cmd_cancel_done);
INIT_WORK(&dev->cmd_complete_work, port100_wq_cmd_complete);
/* The first thing to do with the Port-100 is to set the command type
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment