aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorOliver Neukum <oneukum@suse.com>2019-11-21 11:37:10 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-12-01 09:17:38 +0100
commitaf8071f50f4627fc68ad5f662f200a043dd68472 (patch)
tree5b832fec445de50adeab79df771fde142c6ee5a2
parent3510fb7947d5a7ca662178efe4f8d3712bb85177 (diff)
downloadlinux-yocto-af8071f50f4627fc68ad5f662f200a043dd68472.tar.gz
linux-yocto-af8071f50f4627fc68ad5f662f200a043dd68472.tar.bz2
linux-yocto-af8071f50f4627fc68ad5f662f200a043dd68472.zip
nfc: port100: handle command failure cleanly
commit 5f9f0b11f0816b35867f2cf71e54d95f53f03902 upstream. If starting the transfer of a command suceeds but the transfer for the reply fails, it is not enough to initiate killing the transfer for the command may still be running. You need to wait for the killing to finish before you can reuse URB and buffer. Reported-and-tested-by: syzbot+711468aa5c3a1eabf863@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/nfc/port100.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
index bb43cebda9dc..60ae382f50da 100644
--- a/drivers/nfc/port100.c
+++ b/drivers/nfc/port100.c
@@ -792,7 +792,7 @@ static int port100_send_frame_async(struct port100 *dev, struct sk_buff *out,
rc = port100_submit_urb_for_ack(dev, GFP_KERNEL);
if (rc)
- usb_unlink_urb(dev->out_urb);
+ usb_kill_urb(dev->out_urb);
exit:
mutex_unlock(&dev->out_urb_lock);