• Felipe F. Tonello's avatar
    usb: gadget: f_midi: added spinlock on transmit function · 9acdf4df
    Felipe F. Tonello authored
    Since f_midi_transmit is called by both ALSA and USB sub-systems, it can
    potentially cause a race condition between both calls because f_midi_transmit
    is not reentrant nor thread-safe. This is due to an implementation detail that
    the transmit function looks for the next available usb request from the fifo
    and only enqueues it if there is data to send, otherwise just re-uses it. So,
    if both ALSA and USB frameworks calls this function at the same time,
    kfifo_seek() will return the same usb_request, which will cause a race
    condition.
    
    To solve this problem a syncronization mechanism is necessary. In this case it
    is used a spinlock since f_midi_transmit is also called by usb_request->complete
    callback in interrupt context.
    
    Cc: <stable@vger.kernel.org> # v4.5+
    Fixes: e1e3d7ec ("usb: gadget: f_midi: pre-allocate IN requests")
    Signed-off-by: default avatarFelipe F. Tonello <eu@felipetonello.com>
    Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
    9acdf4df
f_midi.c 30.5 KB