From mboxrd@z Thu Jan 1 00:00:00 1970 From: Subject: [PATCH v7 1/4] [v6 fix] mfd/rtsx_usb: fix possible race condition Date: Fri, 11 Apr 2014 14:53:20 +0800 Message-ID: <1397199203-2235-2-git-send-email-rogerable@realtek.com> References: <1397199203-2235-1-git-send-email-rogerable@realtek.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1397199203-2235-1-git-send-email-rogerable@realtek.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: driverdev-devel-bounces@linuxdriverproject.org Sender: driverdev-devel-bounces@linuxdriverproject.org To: Samuel Ortiz , Lee Jones , Chris Ball , Greg Kroah-Hartman , Maxim Levitsky , Alex Dubov , Dan Carpenter , Ulf Hansson , Andrew Morton , Oliver Neukum Cc: driverdev-devel@linuxdriverproject.org, linux-mmc@vger.kernel.org, linux-kernel@vger.kernel.org, wei_wang@realsil.com.cn, rogerable@realtek.com List-Id: linux-mmc@vger.kernel.org From: Roger Tseng Fix two possible race condition generated by misuse of del_timer in rtsx_usb_bulk_transfer_sglist() and uninitialized timers before mfd_add_devices in rtsx_usb_probe(). Signed-off-by: Roger Tseng --- drivers/mfd/rtsx_usb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c index b53b9d4..0ca7973 100644 --- a/drivers/mfd/rtsx_usb.c +++ b/drivers/mfd/rtsx_usb.c @@ -67,7 +67,7 @@ static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr, ucr->sg_timer.expires = jiffies + msecs_to_jiffies(timeout); add_timer(&ucr->sg_timer); usb_sg_wait(&ucr->current_sg); - del_timer(&ucr->sg_timer); + del_timer_sync(&ucr->sg_timer); if (act_len) *act_len = ucr->current_sg.bytes; @@ -644,14 +644,14 @@ static int rtsx_usb_probe(struct usb_interface *intf, if (ret) goto out_init_fail; + /* initialize USB SG transfer timer */ + setup_timer(&ucr->sg_timer, rtsx_usb_sg_timed_out, (unsigned long) ucr); + ret = mfd_add_devices(&intf->dev, usb_dev->devnum, rtsx_usb_cells, ARRAY_SIZE(rtsx_usb_cells), NULL, 0, NULL); if (ret) goto out_init_fail; - /* initialize USB SG transfer timer */ - init_timer(&ucr->sg_timer); - setup_timer(&ucr->sg_timer, rtsx_usb_sg_timed_out, (unsigned long) ucr); #ifdef CONFIG_PM intf->needs_remote_wakeup = 1; usb_enable_autosuspend(usb_dev); -- 1.8.2