diff options
| author | Ganapathi Bhat <gbhat@marvell.com> | 2018-08-21 09:53:01 +0200 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2018-08-31 17:46:53 +0200 |
| commit | 7bd4628c2f31c51254aa39628ecae521d00d0b90 (patch) | |
| tree | 9ada4404ce1058d7c1403d87fea6e6572fde0580 /drivers/net/wireless | |
| parent | rtl8187: Fix warning generated when strncpy() destination length matches the ... (diff) | |
| download | linux-7bd4628c2f31c51254aa39628ecae521d00d0b90.tar.xz linux-7bd4628c2f31c51254aa39628ecae521d00d0b90.zip | |
mwifiex: do no submit URB in suspended state
There is a possible race between USB suspend and main thread:
1. After processing the command response, main thread will submit
rx_cmd URB back so as to process next command response, by
calling mwifiex_usb_submit_rx_urb.
2. During USB suspend, the suspend handler will check if rx_cmd
URB is pending(submitted) and if true, kill this URB.
There is a possible race between #1 and #2, where rx_cmd URB will
be submitted by main thread(#1) after the suspend handler check
in #2.
To fix this, check if device is already suspended in
mwifiex_usb_submit_rx_urb, in which case do not submit the URB.
Signed-off-by: Vidya Dharmaraju <vidyad@marvell.com>
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/usb.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c index 433c6a16870b..76d80fd54523 100644 --- a/drivers/net/wireless/marvell/mwifiex/usb.c +++ b/drivers/net/wireless/marvell/mwifiex/usb.c @@ -298,6 +298,13 @@ static int mwifiex_usb_submit_rx_urb(struct urb_context *ctx, int size) struct mwifiex_adapter *adapter = ctx->adapter; struct usb_card_rec *card = (struct usb_card_rec *)adapter->card; + if (test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) { + mwifiex_dbg(adapter, ERROR, + "%s: card removed/suspended, EP %d rx_cmd URB submit skipped\n", + __func__, ctx->ep); + return -1; + } + if (card->rx_cmd_ep != ctx->ep) { ctx->skb = dev_alloc_skb(size); if (!ctx->skb) { |