nfc: port100: handle command failure cleanly
If starting the transfer of a command suceeds but the transfer for the reply fails, it is not enough to initiate killing the transfer for the command may still be running. You need to wait for the killing to finish before you can reuse URB and buffer. Reported-and-tested-by: syzbot+711468aa5c3a1eabf863@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
48a322b6f9
commit
5f9f0b11f0
|
@ -783,7 +783,7 @@ static int port100_send_frame_async(struct port100 *dev, struct sk_buff *out,
|
|||
|
||||
rc = port100_submit_urb_for_ack(dev, GFP_KERNEL);
|
||||
if (rc)
|
||||
usb_unlink_urb(dev->out_urb);
|
||||
usb_kill_urb(dev->out_urb);
|
||||
|
||||
exit:
|
||||
mutex_unlock(&dev->out_urb_lock);
|
||||
|
|
Loading…
Reference in New Issue