diff options
| author | Johan Hovold <johan@kernel.org> | 2016-05-08 20:07:59 +0200 |
|---|---|---|
| committer | Johan Hovold <johan@kernel.org> | 2016-05-10 09:39:49 +0200 |
| commit | 61924505ae0037527879446b36ac27c60210bc77 (patch) | |
| tree | d12df7d6b3b66109e174736e7ab1db152df07df9 /drivers/usb | |
| parent | USB: serial: keyspan: fix use-after-free in probe error path (diff) | |
| download | linux-61924505ae0037527879446b36ac27c60210bc77.tar.xz linux-61924505ae0037527879446b36ac27c60210bc77.zip | |
USB: serial: keyspan: fix URB unlink
A driver must not rely on the URB status field to try to determine if an
URB is active.
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/serial/keyspan.c | 26 |
1 files changed, 10 insertions, 16 deletions
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c index 1cf05883f48c..86d54932843d 100644 --- a/drivers/usb/serial/keyspan.c +++ b/drivers/usb/serial/keyspan.c @@ -1082,12 +1082,6 @@ static int keyspan_open(struct tty_struct *tty, struct usb_serial_port *port) return 0; } -static inline void stop_urb(struct urb *urb) -{ - if (urb && urb->status == -EINPROGRESS) - usb_kill_urb(urb); -} - static void keyspan_dtr_rts(struct usb_serial_port *port, int on) { struct keyspan_port_private *p_priv = usb_get_serial_port_data(port); @@ -1114,10 +1108,10 @@ static void keyspan_close(struct usb_serial_port *port) p_priv->out_flip = 0; p_priv->in_flip = 0; - stop_urb(p_priv->inack_urb); + usb_kill_urb(p_priv->inack_urb); for (i = 0; i < 2; i++) { - stop_urb(p_priv->in_urbs[i]); - stop_urb(p_priv->out_urbs[i]); + usb_kill_urb(p_priv->in_urbs[i]); + usb_kill_urb(p_priv->out_urbs[i]); } } @@ -2365,9 +2359,9 @@ static void keyspan_disconnect(struct usb_serial *serial) s_priv = usb_get_serial_data(serial); - stop_urb(s_priv->instat_urb); - stop_urb(s_priv->glocont_urb); - stop_urb(s_priv->indat_urb); + usb_kill_urb(s_priv->instat_urb); + usb_kill_urb(s_priv->glocont_urb); + usb_kill_urb(s_priv->indat_urb); } static void keyspan_release(struct usb_serial *serial) @@ -2495,11 +2489,11 @@ static int keyspan_port_remove(struct usb_serial_port *port) p_priv = usb_get_serial_port_data(port); - stop_urb(p_priv->inack_urb); - stop_urb(p_priv->outcont_urb); + usb_kill_urb(p_priv->inack_urb); + usb_kill_urb(p_priv->outcont_urb); for (i = 0; i < 2; i++) { - stop_urb(p_priv->in_urbs[i]); - stop_urb(p_priv->out_urbs[i]); + usb_kill_urb(p_priv->in_urbs[i]); + usb_kill_urb(p_priv->out_urbs[i]); } usb_free_urb(p_priv->inack_urb); |