diff options
| author | Roger Tseng <rogerable@realtek.com> | 2014-04-11 14:53:20 +0800 |
|---|---|---|
| committer | Lee Jones <lee.jones@linaro.org> | 2014-04-28 11:00:57 +0100 |
| commit | fea52b8910f6f5438790dbd2de45003ce08d01a5 (patch) | |
| tree | 3d20ce08ebc05ba45064c81517f65d7fd6d39c7c /drivers/mfd/rtsx_usb.c | |
| parent | a798c10faf62a505d24e5f6213fbaf904a39623f (diff) | |
| download | lwn-fea52b8910f6f5438790dbd2de45003ce08d01a5.tar.gz lwn-fea52b8910f6f5438790dbd2de45003ce08d01a5.zip | |
mfd: rtsx_usb: Fix possible race condition
Fix two possible race condition generated by misuse of del_timer in
rtsx_usb_bulk_transfer_sglist() and uninitialized timers before mfd_add_devices
in rtsx_usb_probe().
Signed-off-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Diffstat (limited to 'drivers/mfd/rtsx_usb.c')
| -rw-r--r-- | drivers/mfd/rtsx_usb.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c index b53b9d46cc45..0ca79736afe9 100644 --- a/drivers/mfd/rtsx_usb.c +++ b/drivers/mfd/rtsx_usb.c @@ -67,7 +67,7 @@ static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr, ucr->sg_timer.expires = jiffies + msecs_to_jiffies(timeout); add_timer(&ucr->sg_timer); usb_sg_wait(&ucr->current_sg); - del_timer(&ucr->sg_timer); + del_timer_sync(&ucr->sg_timer); if (act_len) *act_len = ucr->current_sg.bytes; @@ -644,14 +644,14 @@ static int rtsx_usb_probe(struct usb_interface *intf, if (ret) goto out_init_fail; + /* initialize USB SG transfer timer */ + setup_timer(&ucr->sg_timer, rtsx_usb_sg_timed_out, (unsigned long) ucr); + ret = mfd_add_devices(&intf->dev, usb_dev->devnum, rtsx_usb_cells, ARRAY_SIZE(rtsx_usb_cells), NULL, 0, NULL); if (ret) goto out_init_fail; - /* initialize USB SG transfer timer */ - init_timer(&ucr->sg_timer); - setup_timer(&ucr->sg_timer, rtsx_usb_sg_timed_out, (unsigned long) ucr); #ifdef CONFIG_PM intf->needs_remote_wakeup = 1; usb_enable_autosuspend(usb_dev); |