Received: by 2002:a25:7ec1:0:0:0:0:0 with SMTP id z184csp6001853ybc; Wed, 27 Nov 2019 13:12:08 -0800 (PST) X-Google-Smtp-Source: APXvYqwDOlGbmY44Cb87rdXmrf76GXyvHj/emsggzljMIHGUAInG6Mh2NU7L2Yo+PW2n6VUVA7zl X-Received: by 2002:a50:ec83:: with SMTP id e3mr34483416edr.292.1574889128690; Wed, 27 Nov 2019 13:12:08 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1574889128; cv=none; d=google.com; s=arc-20160816; b=LxhK6UeLFkI2tg+88ZHuOpCbgWD8vRMXNp2Ly1WTecLIJnKqJpvOWmuJyNEUDfxvs4 iQJBdqeLyOFqlmtJmkUPdo/SII7p/CcTHOKcd1pi+Do2msG+s83M+07cJlk2uL0CKn9n 6TUXR4ovu2OCkKHRc31uDANN8DcNbDRnR5nmMmFiaoBcTKYoKOGfxwlmY5nQGDqXnJwB 2vL8pUQT64fGKwYyDo8votXgzo5UcGuOfxScJx7tdgup9yL4RGTzF3K/F66nksueODGw TgFqsylqdUM6x+Wco3C2+Z0nWDo8/mY0Lp/aqkMMkaINNpI2kAgwlRRbLLYSZ2KSGkMx TUow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=bSYijY/9tyvimLXmyiT+3auLAjPkmyjvYOsdzLthP48=; b=I8W0+dFLgh0TkDRel1je1mjyEfQchb9pEsy57qsXECogiDzAyEKqRKDQ2/RN4nGe4G M1WhSGWxlzJfHYnkmvKx7NtrKlkwX+FDPL4hJmNfzIGUisz0cEUhpTqmU4+zOn4GpsQ1 8s82j/k6/WrDGRq0E3vnzNizO+6Mm6rI294AjpEg6lpJ1H815kIWr6JGXghN245ukkPY BZhVYldP4UMk/M0pmigdgIH36klz3dsY9mHKsVOxewpv0sUtrl5msi356riZG5OftvLP SjmIXKXixfFHBh3NEv4hkL4A26lcHrrdxDxgZYf5kf4+9bmZlvYYqMczWf2/aXH1sDUo Unjg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=nx1J9nCI; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id z4si10417016edp.329.2019.11.27.13.11.45; Wed, 27 Nov 2019 13:12:08 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=nx1J9nCI; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732708AbfK0VIJ (ORCPT + 99 others); Wed, 27 Nov 2019 16:08:09 -0500 Received: from mail.kernel.org ([198.145.29.99]:34416 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732695AbfK0VIE (ORCPT ); Wed, 27 Nov 2019 16:08:04 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E169D20637; Wed, 27 Nov 2019 21:08:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574888884; bh=S8kGG9p6HSMDgtKASDhnwxvtfT614CVOtoxaHvrPciw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nx1J9nCIQ4cSVwZADfWa0Mb86oW97YZ3iBSj9l1cyytEafjv9QWZBvxUYhmGbJKWF +ZwzsLOfsddKrxRM3LpTqRXdeMi6v68fyNZBNFx77Hm1rWphr1jjsNGhabTPWH/U1a OwOuRQDwHJMM6T2Cd1KzlDuR/6KuhYldPKzMsC4o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum , "David S. Miller" , syzbot+711468aa5c3a1eabf863@syzkaller.appspotmail.com Subject: [PATCH 4.19 281/306] nfc: port100: handle command failure cleanly Date: Wed, 27 Nov 2019 21:32:11 +0100 Message-Id: <20191127203135.311115248@linuxfoundation.org> X-Mailer: git-send-email 2.24.0 In-Reply-To: <20191127203114.766709977@linuxfoundation.org> References: <20191127203114.766709977@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Oliver Neukum commit 5f9f0b11f0816b35867f2cf71e54d95f53f03902 upstream. If starting the transfer of a command suceeds but the transfer for the reply fails, it is not enough to initiate killing the transfer for the command may still be running. You need to wait for the killing to finish before you can reuse URB and buffer. Reported-and-tested-by: syzbot+711468aa5c3a1eabf863@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/nfc/port100.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/nfc/port100.c +++ b/drivers/nfc/port100.c @@ -792,7 +792,7 @@ static int port100_send_frame_async(stru rc = port100_submit_urb_for_ack(dev, GFP_KERNEL); if (rc) - usb_unlink_urb(dev->out_urb); + usb_kill_urb(dev->out_urb); exit: mutex_unlock(&dev->out_urb_lock);