usb: wusbcore: fix potential double list_del on urb dequeue
authorThomas Pugliese <thomas.pugliese@gmail.com>
Tue, 4 Mar 2014 17:24:55 +0000 (11:24 -0600)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 7 Mar 2014 20:39:39 +0000 (12:39 -0800)
commit2a6da97ff530650d26570a6a1ec0ac1deac927bd
tree64222edab88045ceda239c12a719fbcafd4889db
parent3c1b2c3ecd3122fe6dded7b012f74021144d95b2
usb: wusbcore: fix potential double list_del on urb dequeue

This patch locks rpipe->seg_lock around the entire transfer segment
cleanup loop in wa_urb_dequeue instead of just one case of the switch
statement.  This fixes a race between __wa_xfer_delayed_run and
wa_urb_dequeue where a transfer segment in the WA_SEG_DELAYED state
could be removed from the rpipe seg_list twice leading to memory
corruption.  It also switches the spin_lock call to use the non-irqsave
version since the xfer->lock is already held and irqs already disabled.

Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/wusbcore/wa-xfer.c