shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-04 10:12:16 +09:00
Code Issues Packages Projects Releases Wiki Activity

USB: cdc-acm: fix write and resume race

Browse Source 
commit e144ed28be upstream.

Fix race between write() and resume() due to improper locking that could
lead to writes being reordered.

Resume must be done atomically and susp_count be protected by the
write_lock in order to prevent racing with write(). This could otherwise
lead to writes being reordered if write() grabs the write_lock after
susp_count is decremented, but before the delayed urb is submitted.

Fixes: 11ea859d64 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")

Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Johan Hovold
2014-05-26 19:23:37 +02:00
committed by Greg Kroah-Hartman
parent c5ece48205
commit 1b3fe0068c
1 changed files with 9 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
drivers/usb/class/cdc-acm.c
View File

@@ -1461,27 +1461,20 @@ static int acm_resume(struct usb_interface *intf)
struct acm *acm = usb_get_intfdata(intf);
struct acm_wb *wb;
int rv = 0;
int cnt;
spin_lock_irq(&acm->read_lock);
acm->susp_count -= 1;
cnt = acm->susp_count;
spin_unlock_irq(&acm->read_lock);
spin_lock(&acm->write_lock);
if (cnt)
return 0;
if (--acm->susp_count)
goto out;
if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) {
rv = usb_submit_urb(acm->ctrlurb, GFP_NOIO);
rv = usb_submit_urb(acm->ctrlurb, GFP_ATOMIC);
spin_lock_irq(&acm->write_lock);
if (acm->delayed_wb) {
wb = acm->delayed_wb;
acm->delayed_wb = NULL;
spin_unlock_irq(&acm->write_lock);
acm_start_wb(acm, wb);
} else {
spin_unlock_irq(&acm->write_lock);
}
/*
@@ -1489,12 +1482,14 @@ static int acm_resume(struct usb_interface *intf)
* do the write path at all cost
*/
if (rv < 0)
goto err_out;
goto out;
rv = acm_submit_read_urbs(acm, GFP_NOIO);
rv = acm_submit_read_urbs(acm, GFP_ATOMIC);
}
out:
spin_unlock(&acm->write_lock);
spin_unlock_irq(&acm->read_lock);
err_out:
return rv;
}