rt2x00: Place mutex around USB register access

There is a buffer, csr_cache which is used to hold copies of data being passed
to the USB stack which can get corrupted if multiple threads attempt to access
CSR registers simultaneously. There is also the possibility if multiple
threads try to access BBP or RF registers for the multiple USB operations
needed to get interleaved leading to incorrect results. This patch introduces
a mutex to prevent such simultaneous access. The interleaved access problem
may also affect the PCI devices but if so that will be handled in a follow-up
patch.

Signed-off-by: Adam Baker <linux@baker-net.org.uk>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 28 insertions, 4 deletions

diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index ab97b0600ec8..a8f0f80ddd21 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -31,6 +31,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/usb.h>
+#include <linux/bug.h>
 
 #include "rt2x00.h"
 #include "rt2x00usb.h"
@@ -52,6 +53,7 @@ int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
             (requesttype == USB_VENDOR_REQUEST_IN) ?
             usb_rcvctrlpipe(usb_dev, 0) : usb_sndctrlpipe(usb_dev, 0);
 
+
         for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
                 status = usb_control_msg(usb_dev, pipe, request, requesttype,
                                          value, offset, buffer, buffer_length,
@@ -76,13 +78,15 @@ int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_vendor_request);
 
-int rt2x00usb_vendor_request_buff(struct rt2x00_dev *rt2x00dev,
-                                  const u8 request, const u8 requesttype,
-                                  const u16 offset, void *buffer,
-                                  const u16 buffer_length, const int timeout)
+int rt2x00usb_vendor_req_buff_lock(struct rt2x00_dev *rt2x00dev,
+                                   const u8 request, const u8 requesttype,
+                                   const u16 offset, void *buffer,
+                                   const u16 buffer_length, const int timeout)
 {
         int status;
 
+        BUG_ON(!mutex_is_locked(&rt2x00dev->usb_cache_mutex));
+
         /*
          * Check for Cache availability.
          */
@@ -103,6 +107,25 @@ int rt2x00usb_vendor_request_buff(struct rt2x00_dev *rt2x00dev,
 
         return status;
 }
+EXPORT_SYMBOL_GPL(rt2x00usb_vendor_req_buff_lock);
+
+int rt2x00usb_vendor_request_buff(struct rt2x00_dev *rt2x00dev,
+                                  const u8 request, const u8 requesttype,
+                                  const u16 offset, void *buffer,
+                                  const u16 buffer_length, const int timeout)
+{
+        int status;
+
+        mutex_lock(&rt2x00dev->usb_cache_mutex);
+
+        status = rt2x00usb_vendor_req_buff_lock(rt2x00dev, request,
+                                                requesttype, offset, buffer,
+                                                buffer_length, timeout);
+
+        mutex_unlock(&rt2x00dev->usb_cache_mutex);
+
+        return status;
+}
 EXPORT_SYMBOL_GPL(rt2x00usb_vendor_request_buff);
 
 /*
@@ -507,6 +530,7 @@ int rt2x00usb_probe(struct usb_interface *usb_intf,
         rt2x00dev->dev = usb_intf;
         rt2x00dev->ops = ops;
         rt2x00dev->hw = hw;
+        mutex_init(&rt2x00dev->usb_cache_mutex);
 
         rt2x00dev->usb_maxpacket =
             usb_maxpacket(usb_dev, usb_sndbulkpipe(usb_dev, 1), 1);