staging: vt6656: Fix URB submitted while active warning.

This error happens because PIPEnsControlOut and PIPEnsControlIn unlock the
spin lock for delay, letting in another thread.

The patch moves the current MP_SET_FLAG to before filling
of sUsbCtlRequest for pControlURB and clears it in event of failing.

Any thread calling either function while fMP_CONTROL_READS or fMP_CONTROL_WRITES
flags set will return STATUS_FAILURE.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Cc: stable@vger.kernel.org # 3.8
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 20 insertions, 8 deletions

diff --git a/drivers/staging/vt6656/usbpipe.c b/drivers/staging/vt6656/usbpipe.c
index 2a020672a14b..22a3dde75aba 100644
--- a/drivers/staging/vt6656/usbpipe.c
+++ b/drivers/staging/vt6656/usbpipe.c
@@ -126,6 +126,11 @@ int PIPEnsControlOut(struct vnt_private *pDevice, u8 byRequest, u16 wValue,
     if (pDevice->Flags & fMP_CONTROL_WRITES)
         return STATUS_FAILURE;
 
+        if (pDevice->Flags & fMP_CONTROL_READS)
+                return STATUS_FAILURE;
+
+        MP_SET_FLAG(pDevice, fMP_CONTROL_WRITES);
+
         pDevice->sUsbCtlRequest.bRequestType = 0x40;
         pDevice->sUsbCtlRequest.bRequest = byRequest;
         pDevice->sUsbCtlRequest.wValue = cpu_to_le16p(&wValue);
@@ -140,12 +145,13 @@ int PIPEnsControlOut(struct vnt_private *pDevice, u8 byRequest, u16 wValue,
 
         ntStatus = usb_submit_urb(pDevice->pControlURB, GFP_ATOMIC);
         if (ntStatus != 0) {
-                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"control send request submission failed: %d\n", ntStatus);
+                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO
+                        "control send request submission failed: %d\n",
+                                ntStatus);
+                MP_CLEAR_FLAG(pDevice, fMP_CONTROL_WRITES);
                 return STATUS_FAILURE;
         }
-        else {
-            MP_SET_FLAG(pDevice, fMP_CONTROL_WRITES);
-        }
+
         spin_unlock_irq(&pDevice->lock);
     for (ii = 0; ii <= USB_CTL_WAIT; ii ++) {
 
@@ -179,6 +185,11 @@ int PIPEnsControlIn(struct vnt_private *pDevice, u8 byRequest, u16 wValue,
     if (pDevice->Flags & fMP_CONTROL_READS)
         return STATUS_FAILURE;
 
+        if (pDevice->Flags & fMP_CONTROL_WRITES)
+                return STATUS_FAILURE;
+
+        MP_SET_FLAG(pDevice, fMP_CONTROL_READS);
+
         pDevice->sUsbCtlRequest.bRequestType = 0xC0;
         pDevice->sUsbCtlRequest.bRequest = byRequest;
         pDevice->sUsbCtlRequest.wValue = cpu_to_le16p(&wValue);
@@ -192,10 +203,11 @@ int PIPEnsControlIn(struct vnt_private *pDevice, u8 byRequest, u16 wValue,
 
         ntStatus = usb_submit_urb(pDevice->pControlURB, GFP_ATOMIC);
         if (ntStatus != 0) {
-                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"control request submission failed: %d\n", ntStatus);
-        }else {
-                MP_SET_FLAG(pDevice, fMP_CONTROL_READS);
-    }
+                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO
+                        "control request submission failed: %d\n", ntStatus);
+                MP_CLEAR_FLAG(pDevice, fMP_CONTROL_READS);
+                return STATUS_FAILURE;
+        }
 
         spin_unlock_irq(&pDevice->lock);
     for (ii = 0; ii <= USB_CTL_WAIT; ii ++) {