mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-28 11:18:45 +07:00
9b7e5208a9
USB MIDI driver has an error recovery mechanism to resubmit the URB in the delayed timer handler, and this may race with the standard start / stop operations. Although both start and stop operations themselves don't race with each other due to the umidi->mutex protection, but this isn't applied to the timer handler. For fixing this potential race, the following changes are applied: - Since the timer handler can't use the mutex, we apply the umidi->disc_lock protection at each input stream URB submission; this also needs to change the GFP flag to GFP_ATOMIC - Add a check of the URB refcount and skip if already submitted - Move the timer cancel call at disconnection to the beginning of the procedure; this assures the in-flight timer handler is gone properly before killing all pending URBs Reported-by: syzbot+0f4ecfe6a2c322c81728@syzkaller.appspotmail.com Reported-by: syzbot+5f1d24c49c1d2c427497@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200710160656.16819-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|---|---|---|
| .. | ||
| 6fire | ||
| bcd2000 | ||
| caiaq | ||
| hiface | ||
| line6 | ||
| misc | ||
| usx2y | ||
| card.c | ||
| card.h | ||
| clock.c | ||
| clock.h | ||
| debug.h | ||
| endpoint.c | ||
| endpoint.h | ||
| format.c | ||
| format.h | ||
| helper.c | ||
| helper.h | ||
| Kconfig | ||
| Makefile | ||
| media.c | ||
| media.h | ||
| midi.c | ||
| midi.h | ||
| mixer_maps.c | ||
| mixer_quirks.c | ||
| mixer_quirks.h | ||
| mixer_s1810c.c | ||
| mixer_s1810c.h | ||
| mixer_scarlett_gen2.c | ||
| mixer_scarlett_gen2.h | ||
| mixer_scarlett.c | ||
| mixer_scarlett.h | ||
| mixer_us16x08.c | ||
| mixer_us16x08.h | ||
| mixer.c | ||
| mixer.h | ||
| pcm.c | ||
| pcm.h | ||
| power.c | ||
| power.h | ||
| proc.c | ||
| proc.h | ||
| quirks-table.h | ||
| quirks.c | ||
| quirks.h | ||
| stream.c | ||
| stream.h | ||
| usbaudio.h | ||
| validate.c | ||