USB: fix thread-unsafe anchor utiliy routines
commitba4fc9c229ab534d0b8b1fc2d96f9b5cd92d1d10
authorChristian Lamparter <chunkeey@googlemail.com>
Tue, 3 Aug 2010 00:32:28 +0000 (3 02:32 +0200)
committerGreg Kroah-Hartman <gregkh@suse.de>
Fri, 13 Aug 2010 20:27:29 +0000 (13 13:27 -0700)
treed9a55c1ce91f97fb5a5f2fb7064f43891c334e64
parent150efe00d1991696b4e1ef48e44403b7fd018d95
USB: fix thread-unsafe anchor utiliy routines

commit b3e670443b7fb8a2d29831b62b44a039c283e351 upstream.

This patch fixes a race condition in two utility routines
related to the removal/unlinking of urbs from an anchor.

If two threads are concurrently accessing the same anchor,
both could end up with the same urb - thinking they are
the exclusive owner.

Alan Stern pointed out a related issue in
usb_unlink_anchored_urbs:

"The URB isn't removed from the anchor until it completes
 (as a by-product of completion, in fact), which might not
 be for quite some time after the unlink call returns.
 In the meantime, the subroutine will keep trying to unlink
 it, over and over again."

Cc: Oliver Neukum <oneukum@suse.de>
Cc: Greg Kroah-Hartman <greg@kroah.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/usb/core/urb.c