USB: OHCI: Fix race between ED unlink and URB submission
authorAlan Stern <stern@rowland.harvard.edu>
Tue, 30 Jun 2015 15:25:54 +0000 (11:25 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 22 Jul 2015 21:46:50 +0000 (14:46 -0700)
commit7d8021c967648accd1b78e5e1ddaad655cd2c61f
treeafd9fdfe29eb3ffdeaac8b2745ff6275d56da475
parent2d2a316765d956bc5cb6bb367b2ec52ca59ab8e9
USB: OHCI: Fix race between ED unlink and URB submission

This patch fixes a bug introduced by commit 977dcfdc6031 ("USB: OHCI:
don't lose track of EDs when a controller dies").  The commit changed
ed_state from ED_UNLINK to ED_IDLE too early, before finish_urb() had
been called.  The user-visible consequence is that the driver
occasionally crashes or locks up when an URB is submitted while
another URB for the same endpoint is being unlinked.

This patch moves the ED state change later, to the right place.  The
drawback is that now we may unnecessarily execute some instructions
multiple times when a controller dies.  Since controllers dying is an
exceptional occurrence, a little wasted time won't matter.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Heiko Przybyl <lil_tux@web.de>
Tested-by: Heiko Przybyl <lil_tux@web.de>
Fixes: 977dcfdc60311e7aa571cabf6f39c36dde13339e
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/host/ohci-q.c