This is a note to let you know that I've just added the patch titled

    USB: uss720 fixup refcount position

to my usb git tree which can be found at
    git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6.git
in the usb-linus branch.

The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)

The patch will hopefully also will be merged in Linus's tree for the
next -rc kernel release.

If you have any questions about this process, please let me know.


>From adaa3c6342b249548ea830fe8e02aa5b45be8688 Mon Sep 17 00:00:00 2001
From: Peter Holik <[email protected]>
Date: Fri, 18 Mar 2011 18:47:44 +0100
Subject: USB: uss720 fixup refcount position

My testprog do a lot of bitbang - after hours i got following warning and my 
machine lockups:
WARNING: at /build/buildd/linux-2.6.38/lib/kref.c:34
After debugging uss720 driver i discovered that the completion callback was 
called before
usb_submit_urb returns. The callback frees the request structure that is krefed 
on return by
usb_submit_urb.

Signed-off-by: Peter Holik <[email protected]>
Acked-by: Thomas Sailer <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
 drivers/usb/misc/uss720.c |    7 +++----
 1 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index f7a2057..8b1d94a 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -177,12 +177,11 @@ static struct uss720_async_request 
*submit_async_request(struct parport_uss720_p
        spin_lock_irqsave(&priv->asynclock, flags);
        list_add_tail(&rq->asynclist, &priv->asynclist);
        spin_unlock_irqrestore(&priv->asynclock, flags);
+       kref_get(&rq->ref_count);
        ret = usb_submit_urb(rq->urb, mem_flags);
-       if (!ret) {
-               kref_get(&rq->ref_count);
+       if (!ret)
                return rq;
-       }
-       kref_put(&rq->ref_count, destroy_async);
+       destroy_async(&rq->ref_count);
        err("submit_async_request submit_urb failed with %d", ret);
        return NULL;
 }
-- 
1.7.4.1


_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable

Reply via email to