cdc-wdm: Fix more races on the read path
authorBen Hutchings <ben@decadent.org.uk>
Sun, 12 Feb 2012 06:00:41 +0000 (06:00 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 24 Feb 2012 21:11:56 +0000 (13:11 -0800)
commit711c68b3c0f7a924ffbee4aa962d8f62b85188ff
tree364aa61ad7714ae92264ae06e304fc4fd8171dd0
parentc192c8e71a2ded01170c1a992cd21aaedc822756
cdc-wdm: Fix more races on the read path

We must not allow the input buffer length to change while we're
shuffling the buffer contents.  We also mustn't clear the WDM_READ
flag after more data might have arrived.  Therefore move both of these
into the spinlocked region at the bottom of wdm_read().

When reading desc->length without holding the iuspin lock, use
ACCESS_ONCE() to ensure the compiler doesn't re-read it with
inconsistent results.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Tested-by: Bjørn Mork <bjorn@mork.no>
Cc: Oliver Neukum <oliver@neukum.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/class/cdc-wdm.c