From c023efa81d74291f43c70c22be6d9a4c1b1f8f81 Mon Sep 17 00:00:00 2001 From: Hante Meuleman Date: Thu, 30 Aug 2012 19:42:58 +0200 Subject: [PATCH] brcmfmac: prevent possible race condition on usb rx control. brcmf_usb_tx_ctlpkt sends message using brcmf_usb_send_ctl then clears boolean and waits for boolean to be set (by another thread). This can result in situation where flag gets cleared while result was already received. First clearing the flag and then sending the data will prevent this. Reviewed-by: Arend Van Spriel (arend@broadcom.com) Reviewed-by: Franky (Zhenhui) Lin Reviewed-by: Pieter-Paul Giesberts Signed-off-by: Hante Meuleman Signed-off-by: Arend van Spriel Signed-off-by: John W. Linville --- drivers/net/wireless/brcm80211/brcmfmac/usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c index a299d42da8e74..ac1ed1fdff944 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c @@ -366,13 +366,13 @@ static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len) if (test_and_set_bit(0, &devinfo->ctl_op)) return -EIO; + devinfo->ctl_completed = false; err = brcmf_usb_send_ctl(devinfo, buf, len); if (err) { brcmf_dbg(ERROR, "fail %d bytes: %d\n", err, len); return err; } - devinfo->ctl_completed = false; timeout = brcmf_usb_ioctl_resp_wait(devinfo, &devinfo->ctl_completed, &pending); clear_bit(0, &devinfo->ctl_op); -- 2.39.5