leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

usb: wusbcore: don't mark WA_SEG_DTI_PENDING segs as done in urb_dequeue

Browse Source 
Data for transfer segments in the WA_SEG_DTI_PENDING state is actively
being read by the driver.  Let the buffer read callback handle the
transfer cleanup since cleaning it up in wa_urb_dequeue will cause the
read callback to access invalid memory if the transfer is completed.

Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Thomas Pugliese 2014-03-04 11:24:56 -06:00 committed by Greg Kroah-Hartman
parent 2a6da97ff5
commit 5090ecea13
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/usb/wusbcore/wa-xfer.c
View File

@ -2005,6 +2005,16 @@ int wa_urb_dequeue(struct wahc *wa, struct urb *urb, int status)
case WA_SEG_DONE:
case WA_SEG_ERROR:
case WA_SEG_ABORTED:
break;
/*
* The buf_in data for a segment in the
* WA_SEG_DTI_PENDING state is actively being read.
* Let wa_buf_in_cb handle it since it will be called
* and will increment xfer->segs_done. Cleaning up
* here could cause wa_buf_in_cb to access the xfer
* after it has been completed/freed.
*/
case WA_SEG_DTI_PENDING:
break;
/*
* In the states below, the HWA device already knows
@ -2015,7 +2025,6 @@ int wa_urb_dequeue(struct wahc *wa, struct urb *urb, int status)
*/
case WA_SEG_SUBMITTED:
case WA_SEG_PENDING:
case WA_SEG_DTI_PENDING:
/*
* Check if the abort was successfully sent. This could
* be false if the HWA has been removed but we haven't