Messages in this thread Patch in this message | | | From | <> | Subject | [PATCH v7 1/4] [v6 fix] mfd/rtsx_usb: fix possible race condition | Date | Fri, 11 Apr 2014 14:53:20 +0800 |
| |
From: Roger Tseng <rogerable@realtek.com>
Fix two possible race condition generated by misuse of del_timer in rtsx_usb_bulk_transfer_sglist() and uninitialized timers before mfd_add_devices in rtsx_usb_probe().
Signed-off-by: Roger Tseng <rogerable@realtek.com> --- drivers/mfd/rtsx_usb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c index b53b9d4..0ca7973 100644 --- a/drivers/mfd/rtsx_usb.c +++ b/drivers/mfd/rtsx_usb.c @@ -67,7 +67,7 @@ static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr, ucr->sg_timer.expires = jiffies + msecs_to_jiffies(timeout); add_timer(&ucr->sg_timer); usb_sg_wait(&ucr->current_sg); - del_timer(&ucr->sg_timer); + del_timer_sync(&ucr->sg_timer); if (act_len) *act_len = ucr->current_sg.bytes; @@ -644,14 +644,14 @@ static int rtsx_usb_probe(struct usb_interface *intf, if (ret) goto out_init_fail; + /* initialize USB SG transfer timer */ + setup_timer(&ucr->sg_timer, rtsx_usb_sg_timed_out, (unsigned long) ucr); + ret = mfd_add_devices(&intf->dev, usb_dev->devnum, rtsx_usb_cells, ARRAY_SIZE(rtsx_usb_cells), NULL, 0, NULL); if (ret) goto out_init_fail; - /* initialize USB SG transfer timer */ - init_timer(&ucr->sg_timer); - setup_timer(&ucr->sg_timer, rtsx_usb_sg_timed_out, (unsigned long) ucr); #ifdef CONFIG_PM intf->needs_remote_wakeup = 1; usb_enable_autosuspend(usb_dev); -- 1.8.2
| |