From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by ash.osuosl.org (Postfix) with ESMTP id 942671C26B5 for ; Tue, 16 Aug 2016 14:11:04 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 8EAAB86785 for ; Tue, 16 Aug 2016 14:11:04 +0000 (UTC) Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KaOil+-MiVeH for ; Tue, 16 Aug 2016 14:11:03 +0000 (UTC) Received: from email.microchip.com (exsmtp01.microchip.com [198.175.253.37]) by whitealder.osuosl.org (Postfix) with ESMTPS id 0A7C18AA59 for ; Tue, 16 Aug 2016 14:11:03 +0000 (UTC) From: Christian Gromm Subject: [PATCH 3/8] staging: most: hdm-usb: synchronize release of struct buf_anchor Date: Tue, 16 Aug 2016 16:10:29 +0200 Message-ID: <1471356634-10261-4-git-send-email-christian.gromm@microchip.com> In-Reply-To: <1471356634-10261-1-git-send-email-christian.gromm@microchip.com> References: <1471356634-10261-1-git-send-email-christian.gromm@microchip.com> MIME-Version: 1.0 List-Id: Linux Driver Project Developer List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: driverdev-devel-bounces@linuxdriverproject.org Sender: "devel" To: gregkh@linuxfoundation.org Cc: Christian Gromm , driverdev-devel@linuxdriverproject.org, Andrey Shvetsov In case a channel that is going to be destroyed has been tagged as not "healthy" by the function hdm_poison_channel() while the functions hdm_write_completion() or hdm_read_completion() are being executed, they race for destruction of buf_anchor. This patch fixes the problem. Signed-off-by: Andrey Shvetsov Signed-off-by: Christian Gromm --- drivers/staging/most/hdm-usb/hdm_usb.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/staging/most/hdm-usb/hdm_usb.c b/drivers/staging/most/hdm-usb/hdm_usb.c index 4156a30..26b5c1b 100644 --- a/drivers/staging/most/hdm-usb/hdm_usb.c +++ b/drivers/staging/most/hdm-usb/hdm_usb.c @@ -285,6 +285,8 @@ static unsigned int get_stream_frame_size(struct most_channel_config *cfg) static int hdm_poison_channel(struct most_interface *iface, int channel) { struct most_dev *mdev; + unsigned long flags; + spinlock_t *lock; /* temp. lock */ mdev = to_mdev(iface); if (unlikely(!iface)) { @@ -296,7 +298,10 @@ static int hdm_poison_channel(struct most_interface *iface, int channel) return -ECHRNG; } + lock = mdev->anchor_list_lock + channel; + spin_lock_irqsave(lock, flags); mdev->is_channel_healthy[channel] = false; + spin_unlock_irqrestore(lock, flags); cancel_work_sync(&mdev->clear_work[channel].ws); @@ -407,8 +412,10 @@ static void hdm_write_completion(struct urb *urb) dev = &mdev->usb_device->dev; lock = mdev->anchor_list_lock + channel; + spin_lock_irqsave(lock, flags); if ((urb->status == -ENOENT) || (urb->status == -ECONNRESET) || (!mdev->is_channel_healthy[channel])) { + spin_unlock_irqrestore(lock, flags); complete(&anchor->urb_compl); return; } @@ -419,6 +426,7 @@ static void hdm_write_completion(struct urb *urb) case -EPIPE: dev_warn(dev, "Broken OUT pipe detected\n"); mdev->is_channel_healthy[channel] = false; + spin_unlock_irqrestore(lock, flags); mbo->status = MBO_E_INVAL; mdev->clear_work[channel].pipe = urb->pipe; schedule_work(&mdev->clear_work[channel].ws); @@ -436,7 +444,6 @@ static void hdm_write_completion(struct urb *urb) mbo->processed_length = urb->actual_length; } - spin_lock_irqsave(lock, flags); list_del(&anchor->list); spin_unlock_irqrestore(lock, flags); kfree(anchor); @@ -571,8 +578,10 @@ static void hdm_read_completion(struct urb *urb) dev = &mdev->usb_device->dev; lock = mdev->anchor_list_lock + channel; + spin_lock_irqsave(lock, flags); if ((urb->status == -ENOENT) || (urb->status == -ECONNRESET) || (!mdev->is_channel_healthy[channel])) { + spin_unlock_irqrestore(lock, flags); complete(&anchor->urb_compl); return; } @@ -583,6 +592,7 @@ static void hdm_read_completion(struct urb *urb) case -EPIPE: dev_warn(dev, "Broken IN pipe detected\n"); mdev->is_channel_healthy[channel] = false; + spin_unlock_irqrestore(lock, flags); mbo->status = MBO_E_INVAL; mdev->clear_work[channel].pipe = urb->pipe; schedule_work(&mdev->clear_work[channel].ws); @@ -606,7 +616,7 @@ static void hdm_read_completion(struct urb *urb) mbo->status = MBO_E_INVAL; } } - spin_lock_irqsave(lock, flags); + list_del(&anchor->list); spin_unlock_irqrestore(lock, flags); kfree(anchor); -- 1.9.1 _______________________________________________ devel mailing list devel@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel