lkml.org 
[lkml]   [2014]   [Apr]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v6 1/4] [v6 fix] mfd/rtsx_usb: fix possible race condition
    Date
    From: Roger Tseng <rogerable@realtek.com>

    Fix two possible race condition generated by misuse of del_timer in
    rtsx_usb_bulk_transfer_sglist() and uninitialized timers before mfd_add_devices
    in rtsx_usb_probe().

    Signed-off-by: Roger Tseng <rogerable@realtek.com>
    ---
    drivers/mfd/rtsx_usb.c | 8 ++++----
    1 file changed, 4 insertions(+), 4 deletions(-)

    diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c
    index b53b9d4..0ca7973 100644
    --- a/drivers/mfd/rtsx_usb.c
    +++ b/drivers/mfd/rtsx_usb.c
    @@ -67,7 +67,7 @@ static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr,
    ucr->sg_timer.expires = jiffies + msecs_to_jiffies(timeout);
    add_timer(&ucr->sg_timer);
    usb_sg_wait(&ucr->current_sg);
    - del_timer(&ucr->sg_timer);
    + del_timer_sync(&ucr->sg_timer);

    if (act_len)
    *act_len = ucr->current_sg.bytes;
    @@ -644,14 +644,14 @@ static int rtsx_usb_probe(struct usb_interface *intf,
    if (ret)
    goto out_init_fail;

    + /* initialize USB SG transfer timer */
    + setup_timer(&ucr->sg_timer, rtsx_usb_sg_timed_out, (unsigned long) ucr);
    +
    ret = mfd_add_devices(&intf->dev, usb_dev->devnum, rtsx_usb_cells,
    ARRAY_SIZE(rtsx_usb_cells), NULL, 0, NULL);
    if (ret)
    goto out_init_fail;

    - /* initialize USB SG transfer timer */
    - init_timer(&ucr->sg_timer);
    - setup_timer(&ucr->sg_timer, rtsx_usb_sg_timed_out, (unsigned long) ucr);
    #ifdef CONFIG_PM
    intf->needs_remote_wakeup = 1;
    usb_enable_autosuspend(usb_dev);
    --
    1.8.2


    \
     
     \ /
      Last update: 2014-04-09 08:41    [W:2.813 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site