diff options
| author | Oliver Neukum <oneukum@suse.com> | 2022-05-12 13:38:48 +0100 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@kernel.org> | 2022-06-20 10:30:33 +0100 |
| commit | 2a7745949386e275ced3b38410e9f174447949df (patch) | |
| tree | 24f5d4a34349cb28904f05cf2335bc0dba0d3a14 | |
| parent | 522f1d7d95fea3238c777148d95c1d793afa40c2 (diff) | |
| download | linux-2a7745949386e275ced3b38410e9f174447949df.tar.bz2 | |
media: igorplugusb: break cyclical race on disconnect
The driver uses a timer, that may submit the URB and
the URB may start the timer. No simple order of killing
can break te cycle. Poison the URB before killing
the timer.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
| -rw-r--r-- | drivers/media/rc/igorplugusb.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c index 1afba95409ff..b2245849f7aa 100644 --- a/drivers/media/rc/igorplugusb.c +++ b/drivers/media/rc/igorplugusb.c @@ -126,7 +126,7 @@ static void igorplugusb_cmd(struct igorplugusb *ir, int cmd) ir->request.bRequest = cmd; ir->urb->transfer_flags = 0; ret = usb_submit_urb(ir->urb, GFP_ATOMIC); - if (ret) + if (ret && ret != -EPERM) dev_err(ir->dev, "submit urb failed: %d", ret); } @@ -223,7 +223,9 @@ static int igorplugusb_probe(struct usb_interface *intf, return 0; fail: + usb_poison_urb(ir->urb); del_timer(&ir->timer); + usb_unpoison_urb(ir->urb); usb_free_urb(ir->urb); rc_free_device(ir->rc); kfree(ir->buf_in); @@ -236,9 +238,10 @@ static void igorplugusb_disconnect(struct usb_interface *intf) struct igorplugusb *ir = usb_get_intfdata(intf); rc_unregister_device(ir->rc); + usb_poison_urb(ir->urb); del_timer_sync(&ir->timer); usb_set_intfdata(intf, NULL); - usb_kill_urb(ir->urb); + usb_unpoison_urb(ir->urb); usb_free_urb(ir->urb); kfree(ir->buf_in); } |