leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mfd: rtsx_usb: Fix possible race condition

Browse Source 
Fix two possible race condition generated by misuse of del_timer in
rtsx_usb_bulk_transfer_sglist() and uninitialized timers before mfd_add_devices
in rtsx_usb_probe().

Signed-off-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
This commit is contained in:
Roger Tseng 2014-04-11 14:53:20 +08:00 committed by Lee Jones
parent a798c10faf
commit fea52b8910
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/mfd/rtsx_usb.c
View File

@ -67,7 +67,7 @@ static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr,
ucr->sg_timer.expires = jiffies + msecs_to_jiffies(timeout); ucr->sg_timer.expires = jiffies + msecs_to_jiffies(timeout);
add_timer(&ucr->sg_timer); add_timer(&ucr->sg_timer);
usb_sg_wait(&ucr->current_sg); usb_sg_wait(&ucr->current_sg);
del_timer(&ucr->sg_timer); del_timer_sync(&ucr->sg_timer);
if (act_len) if (act_len)
*act_len = ucr->current_sg.bytes; *act_len = ucr->current_sg.bytes;
@ -644,14 +644,14 @@ static int rtsx_usb_probe(struct usb_interface *intf,
if (ret) if (ret)
goto out_init_fail; goto out_init_fail;
/* initialize USB SG transfer timer */
setup_timer(&ucr->sg_timer, rtsx_usb_sg_timed_out, (unsigned long) ucr);
ret = mfd_add_devices(&intf->dev, usb_dev->devnum, rtsx_usb_cells, ret = mfd_add_devices(&intf->dev, usb_dev->devnum, rtsx_usb_cells,
ARRAY_SIZE(rtsx_usb_cells), NULL, 0, NULL); ARRAY_SIZE(rtsx_usb_cells), NULL, 0, NULL);
if (ret) if (ret)
goto out_init_fail; goto out_init_fail;
/* initialize USB SG transfer timer */
init_timer(&ucr->sg_timer);
setup_timer(&ucr->sg_timer, rtsx_usb_sg_timed_out, (unsigned long) ucr);
#ifdef CONFIG_PM #ifdef CONFIG_PM
intf->needs_remote_wakeup = 1; intf->needs_remote_wakeup = 1;
usb_enable_autosuspend(usb_dev); usb_enable_autosuspend(usb_dev);