USB: cdc-wdm: fix race between interrupt handler and tasklet

Both could want to submit the same URB. Some checks of the flag
intended to prevent that were missing.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
CC: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 9 insertions, 4 deletions

diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 8a230f0ef77c..d3318a0df8ee 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -209,6 +209,7 @@ skip_error:
 static void wdm_int_callback(struct urb *urb)
 {
         int rv = 0;
+        int responding;
         int status = urb->status;
         struct wdm_device *desc;
         struct usb_cdc_notification *dr;
@@ -262,8 +263,8 @@ static void wdm_int_callback(struct urb *urb)
 
         spin_lock(&desc->iuspin);
         clear_bit(WDM_READ, &desc->flags);
-        set_bit(WDM_RESPONDING, &desc->flags);
-        if (!test_bit(WDM_DISCONNECTING, &desc->flags)
+        responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
+        if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags)
                 && !test_bit(WDM_SUSPENDING, &desc->flags)) {
                 rv = usb_submit_urb(desc->response, GFP_ATOMIC);
                 dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
@@ -685,16 +686,20 @@ static void wdm_rxwork(struct work_struct *work)
 {
         struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);
         unsigned long flags;
-        int rv;
+        int rv = 0;
+        int responding;
 
         spin_lock_irqsave(&desc->iuspin, flags);
         if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
                 spin_unlock_irqrestore(&desc->iuspin, flags);
         } else {
+                responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
                 spin_unlock_irqrestore(&desc->iuspin, flags);
-                rv = usb_submit_urb(desc->response, GFP_KERNEL);
+                if (!responding)
+                        rv = usb_submit_urb(desc->response, GFP_KERNEL);
                 if (rv < 0 && rv != -EPERM) {
                         spin_lock_irqsave(&desc->iuspin, flags);
+                        clear_bit(WDM_RESPONDING, &desc->flags);
                         if (!test_bit(WDM_DISCONNECTING, &desc->flags))
                                 schedule_work(&desc->rxwork);
                         spin_unlock_irqrestore(&desc->iuspin, flags);