* [PATCH] USB: fix concurrent buffer access in the hub driver
@ 2007-02-06 15:31 Alan Stern
0 siblings, 0 replies; only message in thread
From: Alan Stern @ 2007-02-06 15:31 UTC (permalink / raw)
To: Andrew Morton; +Cc: Kernel development list
This patch (as849) fixes a bug in the hub driver. A single
pre-allocated buffer is used for all port status reads, but nothing
guarantees exclusive use of the buffer. A mutex is added to provide
this guarantee.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
---
This patch should go into Greg's USB development tree and -mm as well as
into the 2.6.20-stable queue (submitted separately). It fixes the "usb
somehow broken (CONFIG_USB_SUSPEND)" bug reported by Prakash Punnoor.
Alan Stern
Index: usb-2.6/drivers/usb/core/hub.c
===================================================================
--- usb-2.6.orig/drivers/usb/core/hub.c
+++ usb-2.6/drivers/usb/core/hub.c
@@ -44,6 +44,7 @@ struct usb_hub {
struct usb_hub_status hub;
struct usb_port_status port;
} *status; /* buffer for status reports */
+ struct mutex status_mutex; /* for the status buffer */
int error; /* last reported error */
int nerrors; /* track consecutive errors */
@@ -535,6 +536,7 @@ static int hub_hub_status(struct usb_hub
{
int ret;
+ mutex_lock(&hub->status_mutex);
ret = get_hub_status(hub->hdev, &hub->status->hub);
if (ret < 0)
dev_err (hub->intfdev,
@@ -544,6 +546,7 @@ static int hub_hub_status(struct usb_hub
*change = le16_to_cpu(hub->status->hub.wHubChange);
ret = 0;
}
+ mutex_unlock(&hub->status_mutex);
return ret;
}
@@ -617,6 +620,7 @@ static int hub_configure(struct usb_hub
ret = -ENOMEM;
goto fail;
}
+ mutex_init(&hub->status_mutex);
hub->descriptor = kmalloc(sizeof(*hub->descriptor), GFP_KERNEL);
if (!hub->descriptor) {
@@ -1394,6 +1398,7 @@ static int hub_port_status(struct usb_hu
{
int ret;
+ mutex_lock(&hub->status_mutex);
ret = get_port_status(hub->hdev, port1, &hub->status->port);
if (ret < 4) {
dev_err (hub->intfdev,
@@ -1405,6 +1410,7 @@ static int hub_port_status(struct usb_hu
*change = le16_to_cpu(hub->status->port.wPortChange);
ret = 0;
}
+ mutex_unlock(&hub->status_mutex);
return ret;
}
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2007-02-06 15:31 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2007-02-06 15:31 [PATCH] USB: fix concurrent buffer access in the hub driver Alan Stern
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.