USB: gadgetfs: fix unbounded memory allocation bug

[pandora-kernel.git] / kernel / async.c

diff --git a/kernel/async.c b/kernel/async.c
index d5fe7af..009f516 100644 (file)
--- a/kernel/async.c
+++ b/kernel/async.c
@@ -51,7 +51,7 @@ asynchronous and synchronous parts of the kernel.
 #include <linux/async.h>
 #include <linux/atomic.h>
 #include <linux/ktime.h>
-#include <linux/module.h>
+#include <linux/export.h>
 #include <linux/wait.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
@@ -88,6 +88,13 @@ static async_cookie_t  __lowest_in_progress(struct list_head *running)
 {
        struct async_entry *entry;
 
+       if (!running) { /* just check the entry count */
+               if (atomic_read(&entry_count))
+                       return 0; /* smaller than any cookie */
+               else
+                       return next_cookie;
+       }
+
        if (!list_empty(running)) {
                entry = list_first_entry(running,
                        struct async_entry, list);
@@ -120,7 +127,7 @@ static void async_run_entry_fn(struct work_struct *work)
        struct async_entry *entry =
                container_of(work, struct async_entry, work);
        unsigned long flags;
-       ktime_t calltime, delta, rettime;
+       ktime_t uninitialized_var(calltime), delta, rettime;
 
        /* 1) move self to the running queue */
        spin_lock_irqsave(&async_lock, flags);
@@ -238,9 +245,7 @@ EXPORT_SYMBOL_GPL(async_schedule_domain);
  */
 void async_synchronize_full(void)
 {
-       do {
-               async_synchronize_cookie(next_cookie);
-       } while (!list_empty(&async_running) || !list_empty(&async_pending));
+       async_synchronize_cookie_domain(next_cookie, NULL);
 }
 EXPORT_SYMBOL_GPL(async_synchronize_full);
 
@@ -260,7 +265,7 @@ EXPORT_SYMBOL_GPL(async_synchronize_full_domain);
 /**
  * async_synchronize_cookie_domain - synchronize asynchronous function calls within a certain domain with cookie checkpointing
  * @cookie: async_cookie_t to use as checkpoint
- * @running: running list to synchronize on
+ * @running: running list to synchronize on, NULL indicates all lists
  *
  * This function waits until all asynchronous function calls for the
  * synchronization domain specified by the running list @list submitted
@@ -269,7 +274,7 @@ EXPORT_SYMBOL_GPL(async_synchronize_full_domain);
 void async_synchronize_cookie_domain(async_cookie_t cookie,
                                     struct list_head *running)
 {
-       ktime_t starttime, delta, endtime;
+       ktime_t uninitialized_var(starttime), delta, endtime;
 
        if (initcall_debug && system_state == SYSTEM_BOOTING) {
                printk(KERN_DEBUG "async_waiting @ %i\n", task_pid_nr(current));