NFC: Core must test the device polling state inside the device lock

There can ever be only one call to nfc_targets_found() after polling
has been engaged. This could be from a target discovered event from
the driver, or from an error handler to notify poll will never complete.

Signed-off-by: Eric Lapuyade <eric.lapuyade@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

1 files changed, 7 insertions, 2 deletions

diff --git a/net/nfc/core.c b/net/nfc/core.c
index 32f28326b623..94ccf07374a5 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -571,13 +571,18 @@ int nfc_targets_found(struct nfc_dev *dev,
 
         pr_debug("dev_name=%s n_targets=%d\n", dev_name(&dev->dev), n_targets);
 
-        dev->polling = false;
-
         for (i = 0; i < n_targets; i++)
                 targets[i].idx = dev->target_next_idx++;
 
         device_lock(&dev->dev);
 
+        if (dev->polling == false) {
+                device_unlock(&dev->dev);
+                return 0;
+        }
+
+        dev->polling = false;
+
         dev->targets_generation++;
 
         kfree(dev->targets);