diff options
| author | Johan Hovold <jhovold@gmail.com> | 2013-03-21 12:36:48 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-03-25 13:48:27 -0700 |
| commit | 68a2bed130a10cffbf68620f41d08a900b1d776b (patch) | |
| tree | fc91f52d37ca93f204d389cd7c1d639018221fe3 /drivers/usb/core | |
| parent | 69a3d2125796b3452da1b9fce851af96ac24b3a9 (diff) | |
| download | linux-stable-68a2bed130a10cffbf68620f41d08a900b1d776b.tar.gz linux-stable-68a2bed130a10cffbf68620f41d08a900b1d776b.tar.bz2 linux-stable-68a2bed130a10cffbf68620f41d08a900b1d776b.zip | |
USB: fix urb-poison imbalance
The calls to usb_poison_urb and usb_unpoison_urb are expected to be
balanced. However, if an urb that has not yet been submitted is
poisoned, its reject counter will not be increased as its ep-field is
NULL. A consecutive call to unpoison will thus in fact poison the urb
as its reject counter will be decremented to a negative value,
effectively preventing the urb from being submitted.
Note that there are currently no in-kernel drivers affected by this.
Cc: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/core')
| -rw-r--r-- | drivers/usb/core/urb.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c index e0d9d948218c..16927fa88fbd 100644 --- a/drivers/usb/core/urb.c +++ b/drivers/usb/core/urb.c @@ -683,10 +683,13 @@ EXPORT_SYMBOL_GPL(usb_kill_urb); void usb_poison_urb(struct urb *urb) { might_sleep(); - if (!(urb && urb->dev && urb->ep)) + if (!urb) return; atomic_inc(&urb->reject); + if (!urb->dev || !urb->ep) + return; + usb_hcd_unlink_urb(urb, -ENOENT); wait_event(usb_kill_urb_queue, atomic_read(&urb->use_count) == 0); } |