staging: vt6656: Fix URB submitted while active warning.

This error happens because PIPEnsControlOut and PIPEnsControlIn unlock the
spin lock for delay, letting in another thread.

The patch moves the current MP_SET_FLAG to before filling
of sUsbCtlRequest for pControlURB and clears it in event of failing.

Any thread calling either function while fMP_CONTROL_READS or fMP_CONTROL_WRITES
flags set will return STATUS_FAILURE.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Cc: stable@vger.kernel.org # 3.8
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/vt6656/usbpipe.c b/drivers/staging/vt6656/usbpipe.c
index 2a020672a14b68d1522bb99366596bdd706555ee..22a3dde75aba16a3c3ba71f6c5f1bb1831464f0a 100644 (file)
--- a/drivers/staging/vt6656/usbpipe.c
+++ b/drivers/staging/vt6656/usbpipe.c
@@ -126,6 +126,11 @@ int PIPEnsControlOut(struct vnt_private *pDevice, u8 byRequest, u16 wValue,
     if (pDevice->Flags & fMP_CONTROL_WRITES)
         return STATUS_FAILURE;
 
+       if (pDevice->Flags & fMP_CONTROL_READS)
+               return STATUS_FAILURE;
+
+       MP_SET_FLAG(pDevice, fMP_CONTROL_WRITES);
+
        pDevice->sUsbCtlRequest.bRequestType = 0x40;
        pDevice->sUsbCtlRequest.bRequest = byRequest;
        pDevice->sUsbCtlRequest.wValue = cpu_to_le16p(&wValue);
@@ -140,12 +145,13 @@ int PIPEnsControlOut(struct vnt_private *pDevice, u8 byRequest, u16 wValue,
 
        ntStatus = usb_submit_urb(pDevice->pControlURB, GFP_ATOMIC);
        if (ntStatus != 0) {
-               DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"control send request submission failed: %d\n", ntStatus);
+               DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO
+                       "control send request submission failed: %d\n",
+                               ntStatus);
+               MP_CLEAR_FLAG(pDevice, fMP_CONTROL_WRITES);
                return STATUS_FAILURE;
        }
-       else {
-           MP_SET_FLAG(pDevice, fMP_CONTROL_WRITES);
-       }
+
        spin_unlock_irq(&pDevice->lock);
     for (ii = 0; ii <= USB_CTL_WAIT; ii ++) {
 
@@ -179,6 +185,11 @@ int PIPEnsControlIn(struct vnt_private *pDevice, u8 byRequest, u16 wValue,
     if (pDevice->Flags & fMP_CONTROL_READS)
        return STATUS_FAILURE;
 
+       if (pDevice->Flags & fMP_CONTROL_WRITES)
+               return STATUS_FAILURE;
+
+       MP_SET_FLAG(pDevice, fMP_CONTROL_READS);
+
        pDevice->sUsbCtlRequest.bRequestType = 0xC0;
        pDevice->sUsbCtlRequest.bRequest = byRequest;
        pDevice->sUsbCtlRequest.wValue = cpu_to_le16p(&wValue);
@@ -192,10 +203,11 @@ int PIPEnsControlIn(struct vnt_private *pDevice, u8 byRequest, u16 wValue,
 
        ntStatus = usb_submit_urb(pDevice->pControlURB, GFP_ATOMIC);
        if (ntStatus != 0) {
-               DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"control request submission failed: %d\n", ntStatus);
-       }else {
-               MP_SET_FLAG(pDevice, fMP_CONTROL_READS);
-    }
+               DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO
+                       "control request submission failed: %d\n", ntStatus);
+               MP_CLEAR_FLAG(pDevice, fMP_CONTROL_READS);
+               return STATUS_FAILURE;
+       }
 
        spin_unlock_irq(&pDevice->lock);
     for (ii = 0; ii <= USB_CTL_WAIT; ii ++) {