usbfs: Kill urbs on interface before doing a set_interface

The usb_set_interface documentation says:

 * Also, drivers must not change altsettings while urbs are scheduled for
 * endpoints in that interface; all such urbs must first be completed
 * (perhaps forced by unlinking).

For in kernel drivers we trust the drivers to get this right, but we
cannot trust userspace to get this right, so enforce it by killing any
urbs still pending on the interface.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index f3ba2e076ee39dc153ab37d2e0bb3d1c822b310f..2a95e4e574bb8908163947c8229c5b6d8ebfb664 100644 (file)
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1143,6 +1143,9 @@ static int proc_setintf(struct dev_state *ps, void __user *arg)
                return -EFAULT;
        if ((ret = checkintf(ps, setintf.interface)))
                return ret;
+
+       destroy_async_on_interface(ps, setintf.interface);
+
        return usb_set_interface(ps->dev, setintf.interface,
                        setintf.altsetting);
 }