From 68a2bed130a10cffbf68620f41d08a900b1d776b Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Thu, 21 Mar 2013 12:36:48 +0100 Subject: [PATCH] USB: fix urb-poison imbalance The calls to usb_poison_urb and usb_unpoison_urb are expected to be balanced. However, if an urb that has not yet been submitted is poisoned, its reject counter will not be increased as its ep-field is NULL. A consecutive call to unpoison will thus in fact poison the urb as its reject counter will be decremented to a negative value, effectively preventing the urb from being submitted. Note that there are currently no in-kernel drivers affected by this. Cc: Alan Stern Acked-by: Alan Stern Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/urb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c index e0d9d948218c..16927fa88fbd 100644 --- a/drivers/usb/core/urb.c +++ b/drivers/usb/core/urb.c @@ -683,10 +683,13 @@ EXPORT_SYMBOL_GPL(usb_kill_urb); void usb_poison_urb(struct urb *urb) { might_sleep(); - if (!(urb && urb->dev && urb->ep)) + if (!urb) return; atomic_inc(&urb->reject); + if (!urb->dev || !urb->ep) + return; + usb_hcd_unlink_urb(urb, -ENOENT); wait_event(usb_kill_urb_queue, atomic_read(&urb->use_count) == 0); }