summaryrefslogtreecommitdiff
path: root/drivers/nfc
diff options
context:
space:
mode:
authorOliver Neukum <oneukum@suse.com>2019-11-21 11:37:10 +0100
committerDavid S. Miller <davem@davemloft.net>2019-11-21 11:48:17 -0800
commit5f9f0b11f0816b35867f2cf71e54d95f53f03902 (patch)
treebe2351a27135d97fbc97c2ad6bbce0b5de08c8ca /drivers/nfc
parent48a322b6f9965b2f1e4ce81af972f0e287b07ed0 (diff)
nfc: port100: handle command failure cleanly
If starting the transfer of a command suceeds but the transfer for the reply fails, it is not enough to initiate killing the transfer for the command may still be running. You need to wait for the killing to finish before you can reuse URB and buffer. Reported-and-tested-by: syzbot+711468aa5c3a1eabf863@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/nfc')
-rw-r--r--drivers/nfc/port100.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
index 145ddf3f0a45..604dba4f18af 100644
--- a/drivers/nfc/port100.c
+++ b/drivers/nfc/port100.c
@@ -783,7 +783,7 @@ static int port100_send_frame_async(struct port100 *dev, struct sk_buff *out,
rc = port100_submit_urb_for_ack(dev, GFP_KERNEL);
if (rc)
- usb_unlink_urb(dev->out_urb);
+ usb_kill_urb(dev->out_urb);
exit:
mutex_unlock(&dev->out_urb_lock);