Commit 96c706ed authored by Oliver Neukum's avatar Oliver Neukum Committed by Greg Kroah-Hartman

USB: io_edgeport race condition in counters

io_edgeport is using a global variable without locking.
This is _the_ classical race condition. This patch switches to atomic_t.
Signed-off-by: default avatarOliver Neukum <oneukum@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent e198a314
...@@ -212,7 +212,7 @@ static int debug; ...@@ -212,7 +212,7 @@ static int debug;
static int low_latency = 1; /* tty low latency flag, on by default */ static int low_latency = 1; /* tty low latency flag, on by default */
static int CmdUrbs = 0; /* Number of outstanding Command Write Urbs */ static atomic_t CmdUrbs; /* Number of outstanding Command Write Urbs */
/* local function prototypes */ /* local function prototypes */
...@@ -779,8 +779,8 @@ static void edge_bulk_out_cmd_callback (struct urb *urb) ...@@ -779,8 +779,8 @@ static void edge_bulk_out_cmd_callback (struct urb *urb)
dbg("%s", __FUNCTION__); dbg("%s", __FUNCTION__);
CmdUrbs--; atomic_dec(&CmdUrbs);
dbg("%s - FREE URB %p (outstanding %d)", __FUNCTION__, urb, CmdUrbs); dbg("%s - FREE URB %p (outstanding %d)", __FUNCTION__, urb, atomic_read(&CmdUrbs));
/* clean up the transfer buffer */ /* clean up the transfer buffer */
...@@ -2317,8 +2317,8 @@ static int write_cmd_usb (struct edgeport_port *edge_port, unsigned char *buffer ...@@ -2317,8 +2317,8 @@ static int write_cmd_usb (struct edgeport_port *edge_port, unsigned char *buffer
if (!urb) if (!urb)
return -ENOMEM; return -ENOMEM;
CmdUrbs++; atomic_inc(&CmdUrbs);
dbg("%s - ALLOCATE URB %p (outstanding %d)", __FUNCTION__, urb, CmdUrbs); dbg("%s - ALLOCATE URB %p (outstanding %d)", __FUNCTION__, urb, atomic_read(&CmdUrbs));
usb_fill_bulk_urb (urb, edge_serial->serial->dev, usb_fill_bulk_urb (urb, edge_serial->serial->dev,
usb_sndbulkpipe(edge_serial->serial->dev, edge_serial->bulk_out_endpoint), usb_sndbulkpipe(edge_serial->serial->dev, edge_serial->bulk_out_endpoint),
...@@ -2332,7 +2332,7 @@ static int write_cmd_usb (struct edgeport_port *edge_port, unsigned char *buffer ...@@ -2332,7 +2332,7 @@ static int write_cmd_usb (struct edgeport_port *edge_port, unsigned char *buffer
dev_err(&edge_port->port->dev, "%s - usb_submit_urb(write command) failed, status = %d\n", __FUNCTION__, status); dev_err(&edge_port->port->dev, "%s - usb_submit_urb(write command) failed, status = %d\n", __FUNCTION__, status);
usb_kill_urb(urb); usb_kill_urb(urb);
usb_free_urb(urb); usb_free_urb(urb);
CmdUrbs--; atomic_dec(&CmdUrbs);
return status; return status;
} }
...@@ -3083,6 +3083,7 @@ static int __init edgeport_init(void) ...@@ -3083,6 +3083,7 @@ static int __init edgeport_init(void)
retval = usb_register(&io_driver); retval = usb_register(&io_driver);
if (retval) if (retval)
goto failed_usb_register; goto failed_usb_register;
atomic_set(&CmdUrbs, 0);
info(DRIVER_DESC " " DRIVER_VERSION); info(DRIVER_DESC " " DRIVER_VERSION);
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment