diff options
| author | Oliver Neukum | 2019-11-21 11:37:10 +0100 |
|---|---|---|
| committer | David S. Miller | 2019-11-21 11:48:17 -0800 |
| commit | 5f9f0b11f0816b35867f2cf71e54d95f53f03902 (patch) | |
| tree | be2351a27135d97fbc97c2ad6bbce0b5de08c8ca /drivers | |
| parent | 48a322b6f9965b2f1e4ce81af972f0e287b07ed0 (diff) | |
nfc: port100: handle command failure cleanly
If starting the transfer of a command suceeds but the transfer for the reply
fails, it is not enough to initiate killing the transfer for the
command may still be running. You need to wait for the killing to finish
before you can reuse URB and buffer.
Reported-and-tested-by: syzbot+711468aa5c3a1eabf863@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/nfc/port100.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c index 145ddf3f0a45..604dba4f18af 100644 --- a/drivers/nfc/port100.c +++ b/drivers/nfc/port100.c @@ -783,7 +783,7 @@ static int port100_send_frame_async(struct port100 *dev, struct sk_buff *out, rc = port100_submit_urb_for_ack(dev, GFP_KERNEL); if (rc) - usb_unlink_urb(dev->out_urb); + usb_kill_urb(dev->out_urb); exit: mutex_unlock(&dev->out_urb_lock); |