korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-15 06:55:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

brcmfmac: prevent possible race condition on usb rx control.

Browse Source 
brcmf_usb_tx_ctlpkt sends message using brcmf_usb_send_ctl then
clears boolean and waits for boolean to be set (by another
thread). This can result in situation where flag gets cleared
while result was already received. First clearing the flag and
then sending the data will prevent this.

Reviewed-by: Arend Van Spriel (arend@broadcom.com)
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Hante Meuleman 2012-08-30 19:42:58 +02:00 committed by John W. Linville
parent adfbda6224
commit a77f574754
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/wireless/brcm80211/brcmfmac/usb.c
View File

@ -366,13 +366,13 @@ static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
if (test_and_set_bit(0, &devinfo->ctl_op)) if (test_and_set_bit(0, &devinfo->ctl_op))
return -EIO; return -EIO;
devinfo->ctl_completed = false;
err = brcmf_usb_send_ctl(devinfo, buf, len); err = brcmf_usb_send_ctl(devinfo, buf, len);
if (err) { if (err) {
brcmf_dbg(ERROR, "fail %d bytes: %d\n", err, len); brcmf_dbg(ERROR, "fail %d bytes: %d\n", err, len);
return err; return err;
} }
devinfo->ctl_completed = false;
timeout = brcmf_usb_ioctl_resp_wait(devinfo, &devinfo->ctl_completed, timeout = brcmf_usb_ioctl_resp_wait(devinfo, &devinfo->ctl_completed,
&pending); &pending);
clear_bit(0, &devinfo->ctl_op); clear_bit(0, &devinfo->ctl_op);