USB: fix thread-unsafe anchor utiliy routines
authorChristian Lamparter <chunkeey@googlemail.com>
Tue, 3 Aug 2010 00:32:28 +0000 (02:32 +0200)
committerGreg Kroah-Hartman <gregkh@suse.de>
Fri, 13 Aug 2010 20:19:46 +0000 (13:19 -0700)
commit8ea208e908fc9bcaf08cbb1fa7d1a49af35bcd53
tree3e5ba62643cb6ce08742190f291f048f90b66d0d
parentdf13d00a1a1b1212452c41561bcbf294782f4f18
USB: fix thread-unsafe anchor utiliy routines

commit b3e670443b7fb8a2d29831b62b44a039c283e351 upstream.

This patch fixes a race condition in two utility routines
related to the removal/unlinking of urbs from an anchor.

If two threads are concurrently accessing the same anchor,
both could end up with the same urb - thinking they are
the exclusive owner.

Alan Stern pointed out a related issue in
usb_unlink_anchored_urbs:

"The URB isn't removed from the anchor until it completes
 (as a by-product of completion, in fact), which might not
 be for quite some time after the unlink call returns.
 In the meantime, the subroutine will keep trying to unlink
 it, over and over again."

Cc: Oliver Neukum <oneukum@suse.de>
Cc: Greg Kroah-Hartman <greg@kroah.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/usb/core/urb.c