1 files changed, 32 insertions, 31 deletions

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index ec666eb4b7b4..183b41753c98 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -468,14 +468,13 @@ static void acm_read_bulk_callback(struct urb *urb)
 {
         struct acm_rb *rb = urb->context;
         struct acm *acm = rb->instance;
-        unsigned long flags;
         int status = urb->status;
+        bool stopped = false;
+        bool stalled = false;
 
         dev_vdbg(&acm->data->dev, "got urb %d, len %d, status %d\n",
                 rb->index, urb->actual_length, status);
 
-        set_bit(rb->index, &acm->read_urbs_free);
-
         if (!acm->dev) {
                 dev_dbg(&acm->data->dev, "%s - disconnected\n", __func__);
                 return;
@@ -488,15 +487,16 @@ static void acm_read_bulk_callback(struct urb *urb)
                 break;
         case -EPIPE:
                 set_bit(EVENT_RX_STALL, &acm->flags);
-                schedule_work(&acm->work);
-                return;
+                stalled = true;
+                break;
         case -ENOENT:
         case -ECONNRESET:
         case -ESHUTDOWN:
                 dev_dbg(&acm->data->dev,
                         "%s - urb shutting down with status: %d\n",
                         __func__, status);
-                return;
+                stopped = true;
+                break;
         default:
                 dev_dbg(&acm->data->dev,
                         "%s - nonzero urb status received: %d\n",
@@ -505,20 +505,29 @@ static void acm_read_bulk_callback(struct urb *urb)
         }
 
         /*
-         * Unthrottle may run on another CPU which needs to see events
-         * in the same order. Submission has an implict barrier
+         * Make sure URB processing is done before marking as free to avoid
+         * racing with unthrottle() on another CPU. Matches the barriers
+         * implied by the test_and_clear_bit() in acm_submit_read_urb().
          */
         smp_mb__before_atomic();
+        set_bit(rb->index, &acm->read_urbs_free);
+        /*
+         * Make sure URB is marked as free before checking the throttled flag
+         * to avoid racing with unthrottle() on another CPU. Matches the
+         * smp_mb() in unthrottle().
+         */
+        smp_mb__after_atomic();
 
-        /* throttle device if requested by tty */
-        spin_lock_irqsave(&acm->read_lock, flags);
-        acm->throttled = acm->throttle_req;
-        if (!acm->throttled) {
-                spin_unlock_irqrestore(&acm->read_lock, flags);
-                acm_submit_read_urb(acm, rb->index, GFP_ATOMIC);
-        } else {
-                spin_unlock_irqrestore(&acm->read_lock, flags);
+        if (stopped || stalled) {
+                if (stalled)
+                        schedule_work(&acm->work);
+                return;
         }
+
+        if (test_bit(ACM_THROTTLED, &acm->flags))
+                return;
+
+        acm_submit_read_urb(acm, rb->index, GFP_ATOMIC);
 }
 
 /* data interface wrote those outgoing bytes */
@@ -655,10 +664,7 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
         /*
          * Unthrottle device in case the TTY was closed while throttled.
          */
-        spin_lock_irq(&acm->read_lock);
-        acm->throttled = 0;
-        acm->throttle_req = 0;
-        spin_unlock_irq(&acm->read_lock);
+        clear_bit(ACM_THROTTLED, &acm->flags);
 
         retval = acm_submit_read_urbs(acm, GFP_KERNEL);
         if (retval)
@@ -826,24 +832,19 @@ static void acm_tty_throttle(struct tty_struct *tty)
 {
         struct acm *acm = tty->driver_data;
 
-        spin_lock_irq(&acm->read_lock);
-        acm->throttle_req = 1;
-        spin_unlock_irq(&acm->read_lock);
+        set_bit(ACM_THROTTLED, &acm->flags);
 }
 
 static void acm_tty_unthrottle(struct tty_struct *tty)
 {
         struct acm *acm = tty->driver_data;
-        unsigned int was_throttled;
 
-        spin_lock_irq(&acm->read_lock);
-        was_throttled = acm->throttled;
-        acm->throttled = 0;
-        acm->throttle_req = 0;
-        spin_unlock_irq(&acm->read_lock);
+        clear_bit(ACM_THROTTLED, &acm->flags);
+
+        /* Matches the smp_mb__after_atomic() in acm_read_bulk_callback(). */
+        smp_mb();
 
-        if (was_throttled)
-                acm_submit_read_urbs(acm, GFP_KERNEL);
+        acm_submit_read_urbs(acm, GFP_KERNEL);
 }
 
 static int acm_tty_break_ctl(struct tty_struct *tty, int state)