summaryrefslogtreecommitdiff
path: root/drivers/usb/wusbcore
diff options
context:
space:
mode:
authorThomas Pugliese <thomas.pugliese@gmail.com>2014-03-04 21:24:56 +0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2014-03-08 00:39:39 +0400
commit5090ecea133325f762704f00963bca1b024ee691 (patch)
treed2df02d31eacd3ea3cf1ca3e797c0667934c7a2c /drivers/usb/wusbcore
parent2a6da97ff530650d26570a6a1ec0ac1deac927bd (diff)
downloadlinux-5090ecea133325f762704f00963bca1b024ee691.tar.xz
usb: wusbcore: don't mark WA_SEG_DTI_PENDING segs as done in urb_dequeue
Data for transfer segments in the WA_SEG_DTI_PENDING state is actively being read by the driver. Let the buffer read callback handle the transfer cleanup since cleaning it up in wa_urb_dequeue will cause the read callback to access invalid memory if the transfer is completed. Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/wusbcore')
-rw-r--r--drivers/usb/wusbcore/wa-xfer.c11
1 files changed, 10 insertions, 1 deletions
diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index 6e0d377d437c..cf7c95ceebe0 100644
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -2007,6 +2007,16 @@ int wa_urb_dequeue(struct wahc *wa, struct urb *urb, int status)
case WA_SEG_ABORTED:
break;
/*
+ * The buf_in data for a segment in the
+ * WA_SEG_DTI_PENDING state is actively being read.
+ * Let wa_buf_in_cb handle it since it will be called
+ * and will increment xfer->segs_done. Cleaning up
+ * here could cause wa_buf_in_cb to access the xfer
+ * after it has been completed/freed.
+ */
+ case WA_SEG_DTI_PENDING:
+ break;
+ /*
* In the states below, the HWA device already knows
* about the transfer. If an abort request was sent,
* allow the HWA to process it and wait for the
@@ -2015,7 +2025,6 @@ int wa_urb_dequeue(struct wahc *wa, struct urb *urb, int status)
*/
case WA_SEG_SUBMITTED:
case WA_SEG_PENDING:
- case WA_SEG_DTI_PENDING:
/*
* Check if the abort was successfully sent. This could
* be false if the HWA has been removed but we haven't