Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932566AbcKSJ1n (ORCPT ); Sat, 19 Nov 2016 04:27:43 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:58502 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754224AbcKSJZn (ORCPT ); Sat, 19 Nov 2016 04:25:43 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John Stultz , Chen Yu , Michal Nazarewicz , Felipe Balbi Subject: [PATCH 4.8 48/49] usb: gadget: f_fs: edit epfile->ep under lock Date: Sat, 19 Nov 2016 10:23:40 +0100 Message-Id: <20161119092044.266646272@linuxfoundation.org> X-Mailer: git-send-email 2.10.2 In-Reply-To: <20161119092036.698705716@linuxfoundation.org> References: <20161119092036.698705716@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1313 Lines: 46 4.8-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michal Nazarewicz commit 454915dde06a51133750c6745f0ba57361ba209d upstream. epfile->ep is protected by ffs->eps_lock (not epfile->mutex) so clear it while holding the spin lock. Tested-by: John Stultz Tested-by: Chen Yu Signed-off-by: Michal Nazarewicz Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/function/f_fs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1722,17 +1722,17 @@ static void ffs_func_eps_disable(struct unsigned long flags; do { - if (epfile) - mutex_lock(&epfile->mutex); spin_lock_irqsave(&func->ffs->eps_lock, flags); /* pending requests get nuked */ if (likely(ep->ep)) usb_ep_disable(ep->ep); ++ep; + if (epfile) + epfile->ep = NULL; spin_unlock_irqrestore(&func->ffs->eps_lock, flags); if (epfile) { - epfile->ep = NULL; + mutex_lock(&epfile->mutex); kfree(epfile->read_buffer); epfile->read_buffer = NULL; mutex_unlock(&epfile->mutex);