diff options
| author | Thomas Pugliese <thomas.pugliese@gmail.com> | 2014-03-04 11:24:56 -0600 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-03-07 12:39:39 -0800 |
| commit | 5090ecea133325f762704f00963bca1b024ee691 (patch) | |
| tree | d2df02d31eacd3ea3cf1ca3e797c0667934c7a2c /drivers/usb/wusbcore/wa-xfer.c | |
| parent | 2a6da97ff530650d26570a6a1ec0ac1deac927bd (diff) | |
| download | linux-5090ecea133325f762704f00963bca1b024ee691.tar.gz linux-5090ecea133325f762704f00963bca1b024ee691.tar.bz2 linux-5090ecea133325f762704f00963bca1b024ee691.zip | |
usb: wusbcore: don't mark WA_SEG_DTI_PENDING segs as done in urb_dequeue
Data for transfer segments in the WA_SEG_DTI_PENDING state is actively
being read by the driver. Let the buffer read callback handle the
transfer cleanup since cleaning it up in wa_urb_dequeue will cause the
read callback to access invalid memory if the transfer is completed.
Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/wusbcore/wa-xfer.c')
| -rw-r--r-- | drivers/usb/wusbcore/wa-xfer.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c index 6e0d377d437c..cf7c95ceebe0 100644 --- a/drivers/usb/wusbcore/wa-xfer.c +++ b/drivers/usb/wusbcore/wa-xfer.c @@ -2007,6 +2007,16 @@ int wa_urb_dequeue(struct wahc *wa, struct urb *urb, int status) case WA_SEG_ABORTED: break; /* + * The buf_in data for a segment in the + * WA_SEG_DTI_PENDING state is actively being read. + * Let wa_buf_in_cb handle it since it will be called + * and will increment xfer->segs_done. Cleaning up + * here could cause wa_buf_in_cb to access the xfer + * after it has been completed/freed. + */ + case WA_SEG_DTI_PENDING: + break; + /* * In the states below, the HWA device already knows * about the transfer. If an abort request was sent, * allow the HWA to process it and wait for the @@ -2015,7 +2025,6 @@ int wa_urb_dequeue(struct wahc *wa, struct urb *urb, int status) */ case WA_SEG_SUBMITTED: case WA_SEG_PENDING: - case WA_SEG_DTI_PENDING: /* * Check if the abort was successfully sent. This could * be false if the HWA has been removed but we haven't |