Commit c06b99e0 authored by Christian Gromm's avatar Christian Gromm Committed by Greg Kroah-Hartman

staging: most: usb: fix usb_disconnect race condition

The functions usb_disconnect and usb_sndbulkpipe are racing for the struct
usb_device, which might cause a null pointer dereference exception. This
patch fixes this race condition by protecting the critical section inside
the function hdm_enque with the io_mutex.
Signed-off-by: default avatarChristian Gromm <christian.gromm@microchip.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9a32315b
...@@ -565,14 +565,19 @@ static int hdm_enqueue(struct most_interface *iface, int channel, ...@@ -565,14 +565,19 @@ static int hdm_enqueue(struct most_interface *iface, int channel,
mdev = to_mdev(iface); mdev = to_mdev(iface);
conf = &mdev->conf[channel]; conf = &mdev->conf[channel];
dev = &mdev->usb_device->dev;
if (!mdev->usb_device) mutex_lock(&mdev->io_mutex);
return -ENODEV; if (!mdev->usb_device) {
retval = -ENODEV;
goto _exit;
}
dev = &mdev->usb_device->dev;
urb = usb_alloc_urb(NO_ISOCHRONOUS_URB, GFP_ATOMIC); urb = usb_alloc_urb(NO_ISOCHRONOUS_URB, GFP_ATOMIC);
if (!urb) if (!urb) {
return -ENOMEM; retval = -ENOMEM;
goto _exit;
}
if ((conf->direction & MOST_CH_TX) && mdev->padding_active[channel] && if ((conf->direction & MOST_CH_TX) && mdev->padding_active[channel] &&
hdm_add_padding(mdev, channel, mbo)) { hdm_add_padding(mdev, channel, mbo)) {
...@@ -613,12 +618,14 @@ static int hdm_enqueue(struct most_interface *iface, int channel, ...@@ -613,12 +618,14 @@ static int hdm_enqueue(struct most_interface *iface, int channel,
dev_err(dev, "URB submit failed with error %d.\n", retval); dev_err(dev, "URB submit failed with error %d.\n", retval);
goto _error_1; goto _error_1;
} }
return 0; goto _exit;
_error_1: _error_1:
usb_unanchor_urb(urb); usb_unanchor_urb(urb);
_error: _error:
usb_free_urb(urb); usb_free_urb(urb);
_exit:
mutex_unlock(&mdev->io_mutex);
return retval; return retval;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment