p54usb: rewriting rx/tx routines to make use of usb_anchor's facilities
commitdd397dc9dddfa2149a1bbc9e52ac7d5630737cec
authorChristian Lamparter <chunkeey@web.de>
Tue, 9 Dec 2008 14:14:37 +0000 (9 15:14 +0100)
committerJohn W. Linville <linville@tuxdriver.com>
Fri, 12 Dec 2008 19:01:39 +0000 (12 14:01 -0500)
treee96caebf6081bbeb70bc8407342989c0bbda4fbf
parenta07d3619faeea3f540dd55f86685136f8928b4ad
p54usb: rewriting rx/tx routines to make use of usb_anchor's facilities

Alan Stern found several flaws in p54usb's implementation and annotated:
"usb_kill_urb() and similar routines do not expect an URB's completion
routine to deallocate it.  This is almost obvious -- if the URB is deallocated
before the completion routine returns then there's no way for usb_kill_urb
to detect when the URB actually is complete."

This patch addresses all known limitations in the old implementation and fixes
khub's "use-after-freed" hang, when SLUB debug's poisoning option is enabled.

Signed-off-by: Christian Lamparter <chunkeey@web.de>
Cc: stable@kernel.org
Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/p54/p54usb.c
drivers/net/wireless/p54/p54usb.h