summaryrefslogtreecommitdiff
path: root/drivers/hid/intel-ish-hid/ishtp
diff options
context:
space:
mode:
authorSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>2016-11-28 22:23:35 +0300
committerJiri Kosina <jkosina@suse.cz>2016-11-29 17:17:34 +0300
commit6d290391be9233349345d49f4539a87f8cb31c30 (patch)
treebe039f8e7c529d33356bcdd02e7a8aeeb949cb93 /drivers/hid/intel-ish-hid/ishtp
parente5b56aa7906d6995007ffe11ecc181dd876dabd3 (diff)
downloadlinux-6d290391be9233349345d49f4539a87f8cb31c30.tar.xz
HID: intel-ish-hid: Fix potential race condition
Although unlikely but it is possible that when a connect or disconnect request is issued to the firmware, before the response comes, user terminates the client session. In this case when the response is arrived there is no matching client instance in the list of currently active clients. In this case, don't issue call to wake up a waiting client. Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid/intel-ish-hid/ishtp')
-rw-r--r--drivers/hid/intel-ish-hid/ishtp/hbm.c6
1 files changed, 2 insertions, 4 deletions
diff --git a/drivers/hid/intel-ish-hid/ishtp/hbm.c b/drivers/hid/intel-ish-hid/ishtp/hbm.c
index 74bffee60774..59460b66e689 100644
--- a/drivers/hid/intel-ish-hid/ishtp/hbm.c
+++ b/drivers/hid/intel-ish-hid/ishtp/hbm.c
@@ -378,11 +378,10 @@ static void ishtp_hbm_cl_disconnect_res(struct ishtp_device *dev,
list_for_each_entry(cl, &dev->cl_list, link) {
if (!rs->status && ishtp_hbm_cl_addr_equal(cl, rs)) {
cl->state = ISHTP_CL_DISCONNECTED;
+ wake_up_interruptible(&cl->wait_ctrl_res);
break;
}
}
- if (cl)
- wake_up_interruptible(&cl->wait_ctrl_res);
spin_unlock_irqrestore(&dev->cl_list_lock, flags);
}
@@ -431,11 +430,10 @@ static void ishtp_hbm_cl_connect_res(struct ishtp_device *dev,
cl->state = ISHTP_CL_DISCONNECTED;
cl->status = -ENODEV;
}
+ wake_up_interruptible(&cl->wait_ctrl_res);
break;
}
}
- if (cl)
- wake_up_interruptible(&cl->wait_ctrl_res);
spin_unlock_irqrestore(&dev->cl_list_lock, flags);
}